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Foreword _—s_—i. 


f Canada had optimal privacy protection, the Annual Reports from the Office of 

the Privacy Commissioner would be a detailed account of successful interventions 

to protect the rights of individuals, of audits of well run federal institutions with 
mature business processes incorporating privacy requirements, and a thorough 
policy analysis of new information systems and technologies. Instead, reports from 
this office have too often lamented the steady erosion of rights and the assault of 
new surveillance technologies on the daily lives of Canadians, and our impotence to 
reverse the trends. 


This year is no exception. Increasingly, the phenomenon of outsourcing and public- 
private partnerships means the data of Canadians may be in the hands of the private 
sector even when under the control of the government. 


We are generally pleased with the results of our interventions, and with the cooperation 
of business and government alike to try to comply with fair information practices and 
legal requirements, but the privacy threats seem to be multiplying like a bad virus, 
threatening to overwhelm us. 


If there is one central message we want to convey this year, it is that we are not going 
to allow that to happen. We mean business, and we are counting on the support of all 
institutions to help us grapple with these issues and preserve and maintain the privacy 
of the individuals in this country. 


Canadians are anxious, and they expect us to enforce the law and their government to 
respect the values inherent in our Constitution, as recent polling data shows. We will 
do our part, but the defence of these fundamental rights of information protection 
demands a shift in public policy such as has started to take place with respect to the 


Annuat Report To ParLiaMENT 2004-2005 - Report on THE Privacy Act 


environmental movement. Over the last twenty years it has become well accepted 
that it is not alright to pollute, that it is expected behaviour to recycle. We need 
the same thing to happen with respect to personal information: it is not alright to 
gather information without consent, it is not alright to share it promiscuously, it is not 
alright to hide your information practices from your public. 


Three main themes will be found throughout this report, because they are the most 
significant issues we have faced: security and the voracious appetite for personal 
information and surveillance that has sprung up in the post-911 environment, sharing 
of information and outsourcing of data operations across borders, and the need to 
modernize our Privacy Act. Whether you read this report as an individual member 
of the public, a public servant, or a Parliamentarian, there is a message we want to 


convey to you: 


Start caring about privacy now, before it is too late. Citizens’ involvement in the debate 
will determine the course our country takes with regard to the protection of personal 
information. Do your part to control the flow of everyone’s personal information. We 
are here to help, but we cannot do the job alone. 
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ae ee ee ee ee or nee ees Oe ee 


This year, we have published two separate reports, dividing the Privacy Act from the 
Personal Information Protection and Electronic Documents Act (PIPEDA). We felt this 
was more appropriate given that the Privacy Act requires us to report on the fiscal year 
(2004-2005), while under PIPEDA we are required to report on the calendar year (2004). 
As well, each Act provides a separate framework for investigations and audits. Both our 
reports detail efforts we have taken to meet the growing demands on our Office to act as the 
guardians of privacy for Canadians on behalf of Parliament. There 1s much overlapping 
between these reports because many of our activities are not particular to one law or another 
and, increasingly, the policy issues are common across the two regimes. 
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Our Multi-Faceted Mandate 


which applies to federal institutions, and PIPEDA which governs personal 
information management in commercial activities in the private sector. 


]« Office of the Privacy Commissioner (OPC), oversees both the Privacy Act, 


Parliament has given the Office a mandate to ensure that both the federal public 
sector and private sector (in most provinces) are held accountable for their personal 
information handling and that the public is informed about their privacy rights. The 
mandate is not always understood. 


As an independent ombudsman, we are: 


* An investigator and auditor with full powers to investigate and initiate 
complaints, conduct audits and verify compliance under both Acts; 


Sik public educator and advocate with a responsibility both to sensitize businesses 
about their obligations under PIPEDA and to help the public better understand 
their data protection rights; 


- A researcher and expert adviser on privacy issues to Parliament, government 
and businesses; and 


* An advocate for privacy principles involved in litigating the application and 
interpretation of the two privacy laws. We also analyze the legal and policy 
implications of bills and government proposals. 
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Although the Privacy Act does not give the Privacy Commissioner a formal legal 
mandate to conduct public education, the Commissioner often needs to inform the 
public and government in order to achieve her mandate to hold federal government 
departments and agencies accountable for their personal information-handling 
practices. 


Policy Perspective = 


Parliament's Window on Privacy 


he Privacy Commissioner of Canada is an Agent of Parliament who reports 

directly to the Senate and the House of Commons. As such, the OPC acts as 

Parliament’s window on privacy issues. Through the Commissioner, Assistant 
Commissioners and other senior OPC staff, the Office brings to the attention of 
Parliamentarians issues that have an impact on the privacy rights of Canadians. 
The OPC does this by tabling Annual Reports to Parliament, by appearing before 
Committees of the Senate and the House of Commons to comment on the privacy 
implications of proposed legislation and government initiatives, and by identifying 
and analyzing issues that we believe should be brought to Parliament’s attention. 


The Office also assists Parliament in becoming better informed about privacy, acting 
as a resource or centre of expertise on privacy issues. This includes responding 
to a significant number of inquiries and letters from Senators and Members of 
Parliament. 


> Appearances before Parliamentary Committees 


Appearances before committees of the Senate and the House of Commons constitute 
a key element of our work as Parliament’s window on privacy issues. During the 
period covered by this report, the Privacy Commissioner and other senior OPC staff 
appeared 11 times before Parliamentary committees: six times on bills with privacy 
implications; four times on matters relating to the management and operations of the 
Office; and once before a Senate committee studying consumer issues in the financial 


services sector. 
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The OPC appeared on the following bills before Parliamentary committees in 2004- 
2005: 


e Bill C-2, An Act to Amend the Radiocommunication Act (May 6, 2004) 

e Bill C-12, the Quarantine Act (November 18, 2004) 

e Bill C-22, An Act to establish the Department of Social Development and to 
amend and repeal certain related Acts (December 9, 2004) 

e Bill C-23, An Act to establish the Department of Human Resources and Skills 
Development and to amend and repeal certain related Acts (December 9, 2004) 

e Bill C-11, the Pudlic Servants Disclosure Protection Act (December 14, 2004) 

e Bill C-13, An Act to Amend the Criminal Code, the DNA Identification Act and 
the National Defence Act (February 8, 2005) 

e Bill S-18, An Act to Amend the Statistics Act (February 24, 2005) 


Regarding the management and operations of the Office, OPC officials appeared 
before Parliamentary committees on the following matters in 2004-2005: 


e Annual Report and Main Estimates 2003-2004 (November 17, 2004) 
e Supplementary Estimates (December 1, 2004) 

e Funding mechanisms for Agents of Parliament (February 10, 2005) 

e Role and operations of the OPC (February 16, 2005) 


> Other Parliamentary Liaison Activities 


The OPC has undertaken a number of other initiatives over the course of the past 
year to improve its ability to advise Parliament on privacy matters. 


In May 2004, we created a dedicated Parliamentary liaison function within the Office 
to improve our relationship with Parliament. This function resides in the Research 
and Policy Branch, reflecting the OPC’s desire to focus its Parliamentary affairs 
activities on providing in-depth and accurate policy advice to Senators and Members 
of Parliament. 


Improving on how we assess, monitor and forecast Parliamentary activity has been a 
priority for us in the past year. The OPC put in place a new and improved system for 
monitoring the status of bills on Parliament Hill, as well as keeping tabs on new and 
emerging developments of interest to privacy promotion and protection. Our goal 
is to build bridges to departments so that we can comment earlier in the legislative 
process, when our criticisms could be dealt with more effectively. It is often too late 


Poticy Perspective 


when a bill has been introduced in the House of Commons, to rethink approaches to 
information issues. 


The Office has responded to a significant number of inquiries and letters from 
Senators and MPs this year, and the Commissioner and Assistant Commissioners 
have also met privately with Senators and MPs who wished to discuss policy matters 
relating to privacy, or wanted to know more about the operations of the Office. 


In late 2004, the OPC, in conjunction with the Office of the Information Commissioner, 
and in collaboration with the Research Branch of the Library of Parliament, held an 
information session for Parliamentarians and their staff on the roles and mandates of 
both Offices. This information session was well attended and raised many questions 
among participants. We believe such information sessions contribute to increasing 
awareness of privacy issues on Parliament Hill, and look forward to holding more 
such sessions in the future. 


> Priorities for the Coming Year 


The Office expects to be busy in the area of Parliamentary affairs over the next fiscal 
year. [here are a number of bills of interest to us expected in the upcoming session, and 
the statutory review by Parliament of the Personal Information Protection and Electronic 
Documents Act is expected to start in 2006. The OPC plans to play a constructive 
role during this review, by providing thoughtful advice to Parliamentarians 
mandated with studying at how the Act has worked over the course of its first years 
of implementation, and how it may be modified and improved. 


The OPC will continue to follow with interest the Parliamentary review of the Anti- 
terrorism Act. The Privacy Commissioner appeared twice before committee on this 
matter in fiscal year 2005-06—once before a Senate special committee reviewing the 
Act (May 9, 2005), and on another occasion before a sub-committee of the Commons 
Standing Committee on Justice (June 1, 2005). 


We recognize that to act as an effective Agent of Parliament we need to have good 
working relationships with federal departments and agencies. The OPC plans to 
put more emphasis on identifying and raising privacy concerns when government 
initiatives are being developed rather than waiting until they reach Parliament, as this 
increases the possibility that privacy concerns will be taken into account. 
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National Security 


In May 2004 Parliament passed the Public Safety Act. The Act, originally introduced in 
November 2001 in the wake of the September 11 terrorist attacks, allows the Minister 
of Transport, the Commissioner of the Royal Canadian Mounted Police (RCMP) and 
the Director of the Canadian Security Intelligence Service (CSIS) to compel, without a 
warrant, air carriers and operators of aviation reservation systems to provide information 
about passengers. While this may seem reasonable given the risks terrorists pose to air 
transport, authorities are not using this information exclusively for anti-terrorism and 
transportation safety. The Public Safety Act also allows law enforcement authorities to use 
the information to identify passengers with outstanding arrest warrants for a wide range 
of ordinary criminal offences. In other words, the machinery of anti-terrorism is being 
used to meet the needs of ordinary law enforcement, lowering the legal standards that 
law enforcement authorities in a democratic society must meet. 


Another provision in the Public Safety Act amends PIPEDA to allow private sector 
institutions to collect personal information, without clients’ consent, and disclose it to 
government, law enforcement and national security agencies. The amendment applies 
not just to transportation companies but to any institution subject to PIPEDA— 
financial institutions, telecommunications companies and retailers. These disclosures 
effectively co-opt private sector institutions, pressing them into the service of law 
enforcement activities and dangerously blurring the line between the private sector 
and the state. 


Not only is the private sector being deputized by law enforcement; an anti-terrorism 
mindset is permeating more conventional law enforcement and public safety 
initiatives. This mindset threatens to erode our privacy rights and other freedoms 
because the constraints under which national security agencies operate—for example, 
the requirement for judicial authorization—are often weaker than those governing 
law enforcement agencies. 


Debates about public safety are nothing new. They have been underway for several years, 
certainly before 9/11. However, we now hear explicit messages about “intelligence- 
based policing” and vigilance to prevent terrorism from taking hold in our society. 
The proliferation of these messages without an equal attention to the need to protect 
civil liberties is of concern. Implicit in the debate is a general acceptance of various 
types of surveillance, and a marked shift towards the reduction of our civil liberties. A 
state which routinely accepts threats to civil liberties and Charter-protected autonomy 
rights is on spongy ground. 
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While our society must deal with legitimate security concerns, we must also guard 
against fear-mongering and intolerance which threaten a liberal democracy. 


Anti-terrorism Act 


The Anti-terrorism Act (passed in the fall of 2001) requires a Parliamentary review 
after three years. The Senate has appointed a Special Committee to conduct its 
review while the House of Commons has referred the review to the Public Safety 
and National Security Subcommittee of the Standing Committee on Justice, Human 


Rights, Public Safety and Emergency Preparedness. 


In participating in this review, we define the most important questions for the review 
to be: Are the additional law enforcement and surveillance powers necessary and 
proportional to the threats they were intended to address? Have the security benefits 
justified the sacrifice of privacy and other rights? 


We face several challenges preparing for the review, one of which is trying to determine 
whether the extraordinary powers the Anii-terrorism Act granted law enforcement and 
national security agencies are really needed and effective. We have found no empirical 
assessments of their effectiveness in detecting, preventing or deterring terrorist acts. 
Our challenge is compounded by government simultaneously granting new powers 
to law enforcement and national security agencies while weakening transparency and 
accountability. 


The Anti-terrorism Act cannot be viewed in isolation. In the Spring of 2005 we urged 
the two Committees reviewing the Act to interpret their mandates broadly, examining 
the cumulative impact on Canadians’ privacy rights of all the measures passed in the 
wake of the September 11 attacks—amendments to the Aeronautics Act (passed in late 
2001), the Public Safety Act and the Immigration and Refugee Protection Act. 


Transborder Flows of Personal Information 


The Anti-terrorism Act is by no means the only government initiative that threatens 
privacy. Government is collecting, analyzing and sharing more personal information 
helped along by improved technology, new legislation, government reorganization, 
and greater co-operation with foreign states. Flows of personal information are likely 
to have increased significantly among government departments and agencies both 
within and outside Canada. 
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All these factors have fundamentally shifted the relationship between national security, 
law enforcement and informational privacy with a corresponding loss of privacy and 
due process protections for individuals. 


In April 2004, the government issued its first-ever National Security Policy. The 
Policy promised to create an “Integrated Threat Assessment Centre” to help collect, 
analyze and share intelligence and other information—effectively contributing to a 
more integrated international intelligence community. This Centre is housed in CSIS 
but staffed by employees from several departments and agencies. 


Government has been reorganized; creating a new Department of Public Safety 
and Emergency Preparedness Canada, and new agencies such as the Canada Border 
Services Agency (CBSA). Reorganization will intensify information sharing among 
what were once separate entities. 


Some have cited the Privacy Act as a barrier to sharing critical personal information. 
The Privacy Act does not need to be reformed, to facilitate information sharing—that 
is already possible. It needs to be reformed to counter the greater surveillance and the 
intensive transactional data collection we now see. 


Privacy Act reform is not a new idea. Calls for reform date back to the late 1980s, 
long before the advent of today’s surveillance and information technologies. Instead 
of strengthening the Act, the Government has weakened its provisions by measures 
such as those in the Anti-terrorism Act. 


Integrating Information Systems 


Even less visible has been the government’s investment in integrated information 
systems that collect and analyze significant amounts of personal information about 
our travel patterns, financial transactions, and even in some cases the people with 
whom we associate. The systems analyze and mine the personal data in an attempt to 
find patterns that might suggest an individual is a security threat, a money launderer 
or is financing a terrorist group. 


As law enforcement and national security agencies collect more information, from 
more sources, about more individuals, the probability increases that authorities will 
make decisions based on information of questionable accuracy or take information out 
of context. Misuse, misinterpretation or improper disclosures of personal information 
can have serious adverse consequences for individuals, families, and even communities. 
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The problem is aggravated when secrecy provisions and a lack of transparency prevent 
us from determining where the system broke down or why individuals were wrongly 
targeted. 


Not surprisingly, the new “Smart Border” approach to border security has increased 
co-operation and information sharing with the United States. For example, both 
countries have created Integrated Border Enforcement Teams and Integrated Marine 
Enforcement Teams of law enforcement agencies to co-ordinate efforts to target 
cross-border criminal and terrorist activities. 


Increasingly though, Canadians are concerned about information sharing with the 
United States, particularly given American federal departments’ and agencies’ lack of 
oversight on the collection, use and disclosure of personal information. In addition, 
the United States Privacy Act of 1974 does not apply to foreign nationals, thereby 
depriving Canadians and citizens of other countries of certain privacy protections— 
including access and redress rights—under U.S. law. An EKOS Research Associates 
survey commissioned by our Office in March 2005, found 85 per cent of those 
surveyed reporting a moderate or high level of concern about Canadian government 
agencies transferring personal information to foreign governments to protect national 
security. 


The Impact of the USA PATRIOT Act 


These concerns have been highlighted bya provision in the USA PATRIOT Act (Section 
215) that allows a special court to secretly issue an order requiring “the production of 
any tangible things”, possibly including an individual’s personal information, to the 
Federal Bureau of Investigation (FBI). The Act also prohibits anyone served with 
such a secret order from disclosing that they have complied with it, or even that it 
exists. 


In 2004 the British Columbia Information and Privacy Commissioner, David 
Loukidelis, announced that he was examining whether “the USA PATRIOT Act 
permit[s] United States authorities to access personal information of British 
Columbians that is, through the outsourcing of public services, in the custody or 
under the control of USA-linked private sector service providers.” 


The B.C. Commissioner began the review following a proposal that a Canadian 
subsidiary of an American company take over administration of the province's 


Medical Services Plan and PharmaCare programs. Critics of the proposal argued 
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that that this could potentially allow American agencies such as the FBI to obtain 
personal information about Canadians from the American company under the USA 
PATRIOT Act. 


In August 2004, we made a submission to the B.C. Commissioner entitled 
“Transferring Personal Information about Canadians Across Borders —Implications 
of the USA PATRIOT Act’. The submission explained that a company holding 
personal information about Canadian residents in Canada would not be required to 
provide this information to a foreign government or agency in response to a court 
order, even if the company was a subsidiary of a company based in the foreign country. 
In fact, the company would violate PIPEDA if it did disclose the information without 
the individuals’ consent. An exception would allow disclosures of information under 
legislation such as the 2001 amendments to the Aeronautics Act that allow airlines to 
disclose passenger information to foreign states. 


PIPEDA provides further protection by requiring institutions that transfer personal 
information to a third party for processing to use “contractual or other means” to 
ensure that a company located in another country provides comparable protection of 
personal information to that provided in Canada. 


However, our submission acknowledged that companies holding personal information 
about Canadians in a foreign country must comply with that country’s laws and would 
have to disclose personal information in response to a court order. This means that 
a Canadian company outsourcing its personal information processing to the United 
States effectively exposes the information to U.S. law. 


The B.C. government responded to the controversy by passing legislation amending 
the Freedom of Information and Protection of Privacy Act (FOIPPA) and nine other 
Acts. The legislation places restrictions on B.C. public bodies and service providers 
when storing, accessing or disclosing personal information outside Canada. 


Of course, the B.C. legislation does nothing to protect the personal information that 
the federal government transfers outside the country, nor does PIPEDA apply. We 
urged the federal government to examine the circumstances under which it allows 
personal information about Canadians to be processed outside Canada and to 
explain the nature of these transfers to Canadians. The Commissioner observed that 
“Canadians need to understand the full extent to which their personal information 
is transferred across borders and the full extent to which personal information about 
them can be and is made available to foreign governments and institutions”. 
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We followed up early in 2005 with a letter to the President of the Treasury Board 
urging the federal government to review the implications of its outsourcing of personal 
information and to develop contractual clauses to protect personal information 
transferred to third parties for processing. 


The Canada Border Services Agency Audit 


We also began planning an audit of the Canada Border Services Agency (CBSA) that 
will focus on its exchange of information with the United States. The audit’s overall 
objective will be “to assess the extent to which the CBSA is adequately controlling 
and protecting the flow of Canadians’ personal information to foreign governments 
or institutions thereof”. A key element will be reporting and mapping, as much as 
practicable, what information about Canadians CBSA transmits to the United States 
and for what purposes. 


The audit will examine several key operational systems CBSA uses to process the 
personal information collected and shared with U.S. counterparts. The audit will also 
assess the overall robustness of CBSA’s privacy management as well as how it reports 
its privacy management responsibilities to Parliament and the public. 


In closing, the Privacy Commissioner is not opposed to fighting terrorism and 
improving our security; we are not opposed to information sharing. However, we 
must ensure that the steps we take to enhance our security do not end up weakening 
the freedoms that define the society we are defending. We need well-designed laws, 
increased oversight and accountability — and effective checks and balances. 


When we diminish our rights without enhancing security, no one wins. But enhancing 
security without eroding legitimate privacy rights — that’s a win for all. 
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Privacy Act Reform 


his section elaborates on the situation and explains some of the important things 
for the government to consider in updating the Privacy Act, something long 
overdue. 


The privacy landscape is infinitely more complex today than it was a decade ago. 
Faced with increased globalization and extensive outsourcing of personal information 
processing and storage, Canada’s Privacy Act lags woefully behind. 


Today’s commonplace information technologies—the Internet and new surveillance 
technologies such as digital video, linked networks, global positioning systems, black 
boxes in cars, genetic testing, biometric identifiers and radio frequency identification 
devices (RFIDs) —did not exist when the federal Privacy Act came into force in 
1983. Characterizing the current Act as dated in coping with today’s realities is an 
understatement — the Act is tantamount to a cart horse struggling to keep up with 
technologies approaching warp speed. 


New technologies designed for, or capable of, surveillance of individuals are 
widespread and are used not only by law enforcement and national security agencies. 
Businesses, individuals—even your new car—are gathering personal data using 
surveillance cameras, spyware, infrared heat sensors and data mining, often without 
your knowledge or consent. 


Personal information has become a lucrative commodity. Protecting that information 
particularly in the public sector is an ongoing challenge for privacy advocates — one 
that is exacerbated by a federal Privacy Act that contains no effective controls on the 
export of personal information. 
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How We Got Here 


As early as the 1960s, Canadians began questioning the relationship between 
information, privacy and political power. They began to worry that our increasing use 
of computers could lead to loss of individuality or enforce conformity. 


In 1971, in the face of growing concerns, the Departments of Justice and then- 
Communications struck a joint task-force to examine the social and legal implications 
of computer technology. Their study produced the watershed report Privacy and 
Computers whose recommendations led to embedding privacy rights in the Canadian 
Human Rights Act in 1978. 


The current Privacy Act built on and strengthened those rights. It also reflects privacy 
guidelines adopted in 1980 by the Organization for Economic Co-operation and 
Development (OECD), of which Canada is a member. 


Canada is a signatory to several international instruments that stress the seminal 
importance of privacy. The Universal Declaration of Human Rights and the International 
Covenant on Civil and Political Rights, both speak of the right to the protection of the 
law against arbitrary interference with privacy. Our own Supreme Court is gradually 
fleshing out a privacy right through the Canadian Charter of Rights and Freedoms. 
But faced with 21* century threats, the Privacy Act is now an outdated and often 
inadequate public sector data protection law. 


It did not need to be this way. In 1987, three years after the Privacy Act took 
effect, Parliament conducted a required review and issued a comprehensive report 
recommending significant changes. Ten years later, another Parliamentary committee 
recommended a substantial overhaul. Repeated submissions and reports by Privacy 
Commissioners have flagged the toll technology is taking on Canadians’ privacy 
rights. 


The weaknesses are even more striking when the Privacy Act -— a first generation 
data protection law — is measured against the new Personal Information Protection 
and Electronic Documents Act (PIPEDA). In fact, several of the Office of the Privacy 
Commissioner’s concerns could be remedied by adopting provisions similar to those 
in PIPEDA. 
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The New National Security Paradigm 


As mentioned earlier in this report, the events of September 11, 2001 seem to have 
led to national security trumping all else. Of course, Canadians want to protect their 
own safety, as well as that of their allies. The risk—as always—is that vastly expanded 
surveillance systems will steadily erode our privacy (and other) rights, lower our 
reasonable expectation of privacy and autonomy, and ignore the critical question of 
where we must draw the line. 


Both the Anti-terrorism Act and the Public Safety Act, 2002 have established an 
atmosphere conducive to broader surveillance of both individuals and institutions. 
Much of the highly sensitive information about the lives of individuals, families and 
communities is stored in integrated information systems with broad access to law 
enforcement and security communities. 


The cumulative impact of the new legislation is worrying. First, the surveillance 
powers of security and law enforcement agencies have been overly broadened. Second, 
the constraints on use of surveillance powers—including by the Court—have been 
unduly weakened. And finally, government accountability and transparency have been 
significantly reduced. We risk trying to defend our society by means that abrogate the 
fundamental freedoms that define it. 


Transborder Data Flows 


The Privacy Act must now grapple with a world in which “globalization” means not just 
international trade in goods; it also means an extensive traffic in personal information 
for off-shore processing and storage by both governments and the private sector. 
Effectively this moves the information out from under the umbrella of Canadian law 
and potentially into a legal vacuum. 


As we noted above, there has been a steady increase in transfers of personal information 
from government to government, particularly since September 11, 2001, as well as 
from government to companies abroad. The Privacy Act imposes no obligations on 
third parties overseas which hold and process personal information about Canadians. 
There are now no Treasury Board policies governing government institutions on the 
issue, although some are being considered. While we applaud new policies, the Privacy 
Act should contain specific wording to define the responsibilities of those who transfer 
personal information outside the public sector and indeed, outside Canada. 
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Another implication of outsourcing is the exposure of Canadians’ personal information 
to the reach of the USA Patriot Act, which we raised earlier in this report. Canadian 
and U.S. governments already have extensive information sharing agreements for 
law enforcement and security purposes, thus the impact on government records and 
transfers may be slight. However, a decision by a Canadian government institution 
or company to process and store customer data in the U.S. would now expose the 
information to U.S. agencies, effectively nullifying the protection provided by both 
the Privacy Act and PIPEDA. 


Government On-Line or “E-Government” 


The Privacy Act must also struggle with pressures from government agencies—and 
the public, it must be said—to deliver government services on-line. In fact, Canada 
has been remarkably successful. According to an annual survey of international 
government performance, by Accenture, a management consulting and technology 
services company, Canada ranked number one out of 22 countries for the fifth year 
in a row. Serving Canadians on-line is a government priority that promises less 
redundancy of information and better service to citizens. 


However, the demands of e-government threaten the end of information silos which 
provide their own structural protection. Data silos may be antithetical to the concept of 
Government on-line or e-governments; there is no doubt that they are “less efficient”. 
They duplicate information, and you can’t get from one to another. 


In contrast, government on-line may demand interoperable systems that pool personal 
information and make it available to more users for more purposes. The greater the 
amount of information, access, and number of users, the greater the vulnerability of 
the individuals to excessive government or bureaucratic surveillance. 


Can we accept what amounts to a comprehensive personal file and still trust 
government not to misuse it—and, if so, how? 


E-government may provide the critical push needed to make the Privacy Act a much 
more effective privacy framework. The Act must set out more stringent controls on 
access to the information pool. A better Act would also require greater justification 
for collecting information in the first place, one that needs to be clearly articulated. 
And a better Act would also demand a far stricter adherence to the principle that 
personal information be used only for the purposes for which it was collected. 
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E-government is upon us but the law is a long way behind. If government wants to 
become “the most connected to its citizens”, it must also be more protective of its 
citizens. 


Extending the Scope of the Privacy Act 


More than age enfeebles the Privacy Act. Perhaps most critical is the law’s function as 
a data protection statute, not a true privacy law. While not toothless, the best the law 
can manage in some circumstances is to “gum vigorously”. The Act essentially is a set 
of checks and balances on government power. It establishes a set of “fair information 
practices” to regulate federal government collection, use and disclosure of individuals’ 
personal data. And the law gives individuals the right of access to that information. 


Expanding jurisdiction 

As it is, there are gaps in the Privacy Act’s coverage: many institutions, including our 
own Office, are not subject to privacy law. Over the years, the federal government 
has created many entities that do not appear subject to either the Privacy Act or 
PIPEDA, they fall between the chairs. Such entities take the form of boards, tribunals, 
commissions, foundations, institutions, and corporations. They may operate as 
partnerships or joint ventures receiving funds from both the federal government 
and provincial governments. In our view, such a situation significantly weakens 
Parliament’s control with regard to the protection of personal information. Starting 
in the next fiscal year, we have undertaken an audit to determine and confirm the full 
extent of the gap and to assess risks in more detail. So far, we count over 30 entities 
not clearly subject to privacy legislation. 


And as government creates new institutions, a debate ensues on adding (or not) the 
new body to the schedule of those covered. Arguably, the process is clumsy and the 
right sufficiently vital in a democracy to warrant giving the Privacy Act primacy over 
any other Act of Parliament. Thus the law would apply to all federal institutions 
unless the enabling or other departmental legislation expressly declares that it applies 
notwithstanding the Privacy Act. A similar provision already appears in PIPEDA. 


Protecting unrecorded information 
Technology has effectively demonstrated that limiting the Privacy Act's application to 
personal information “recorded in any form” is well past its “best before” date. 


The restrictive definition puts unrecorded information, such as from real-time 
electronic monitoring (live surveillance cameras) or from biological samples, beyond 
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the scope of the Act. Yet the technologies can yield intelligible information about 
identifiable individuals which should benefit from legal protection. 


The proposal is workable; some provincial privacy laws and PIPEDA both apply to 
unrecorded information. For example, a security company in Northwest Territories 
and Nunavut mounted four security cameras on the roof of its building aimed at a 
main intersection in Yellowknife. For several days, 24 hours a day, staff monitored 
a live feed and reported a number of incidents to local police. The monitoring was 
intended to demonstrate the service and generate business for the company. 


Although a public outcry quickly ended the demonstration, the Commissioner had 
the power to investigate and issue findings under PIPEDA which provides helpful 
guidance for other institutions. The Commissioner concluded that while monitoring 
public places may be appropriate for public safety reasons, there must be a demonstrable 
need, it must be done by lawful public authorities and done in ways that incorporate 
all legal privacy safeguards. 


Extending access rights 

Going global also means that Canadian government institutions now hold personal 
information about foreign nationals. For example, the CBSA collects Advance 
Passenger Information/Passenger Name Record of travellers entering Canada. The 
information includes name, date of birth, citizenship, passport or travel document 
number, reservation data and the traveller’s itinerary. Airlines gather the information 
from passengers at the point of departure and send it to CBSA ahead of flight 
arrival. 


However, under the Privacy Act only those present in Canada have the right to seek 
access to their personal information. This means overseas airline passengers, as well 
as immigration applicants, foreign student applicants, and countless other foreigners 
with information in Canadian government files, have no legal right to examine 
the information, to know how it is used or disclosed, or to complain to the Privacy 
Commissioner. 


It is becoming increasingly difficult to justify hedging access rights in the face of 
international mobility and the ensuing exchange of personal data. Nor, in fact, does it 
appear balanced when other countries grant access rights to Canadians. For example, 
the European directive on privacy rights (with which 25 member states comply) 
grants access rights to “every data subject”—anyone whose information is held by a 
European entity. 
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The CBSA’s collection of passenger information highlighted both the Privacy 
Acts shortcomings and the difficulties of ensuring even-handed treatment of the 
information. Although the CBSA has agreed “to administratively extend these rights 
to citizens who are not present in Canada”, both the European Union’s Working 
Group and the Privacy Commissioner would prefer that the law grant access to 
anyone. 


Controlling data matching—effectively 

Although government use of data matching (or “computer-matching”) arguably poses 
the greatest threat to individuals’ privacy, the Privacy Act is silent on the practice. 
Privacy Commissioners (bolstered by Parliamentary Committees) have all recognized 
the dangers inherent in excessive and unrelated data collection. All have recommended 
amending the Privacy Act to ensure that government institutions link personal records 
in discrete systems only when demonstrably necessary, and under the continued 
vigilant oversight of the Privacy Commissioner of Canada. The recommendations 
have not been followed through. 


Granted not all improvements to the Act require legislative changes; administrative 
or policy directives often can fill the bill. But the Treasury Board issued guidelines 
in 1989 outlining the steps departments should take before matching data, including 
submitting a detailed proposal for the Privacy Commissioner’s review. Given how few 
data matching proposals the Office of the Privacy Commissioner has recetved—and 
the likely extent of the practice—it is time to set out the obligations in law. 


Limiting collection 

Limiting collection is a fundamental principle of all data protection statutes. The 
Privacy Act requires government institutions to collect only personal information that 
is “directly related to” an operating program or activity authorized by Parliament. 
This gives government latitude to design programs with a defined set of personal 
information in mind. A more rigorous test would require institutions to demonstrate 
that the information is necessary for the program or activity. 


Although the Treasury Board interprets the Privacy Act in this manner, Parliament 
should amend the law to put the matter beyond interpretation. 


Government Transparency 

The Privacy Act requires government institutions to inform individuals of the reason 
for collecting personal information. However, this response does not truly respect 
individuals’ rights to control the collection, use and disclosure of their information. 
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A more meaningful explanation, and one more in keeping with modern data protection 


principles, should specify: 


a) the authority under which the information is being collected; 
b) the uses to which the information may be put; 

c) the institutions with which the information may be shared; 
d) whether the information is discretionary or mandatory; 

e) the consequences of not providing the information; and 

f) the individual’s right to complain under the Privacy Act. 


“Publicly available” 

One exception to the Privacy Act's use and disclosure provisions is material that is 
“publicly available”. This includes, for example, information available in public 
archives, libraries and museums. However, it also includes information contained in 
such public registries as the Bankruptcy Registry and the Lobbyist Registry. While 
there are good reasons for making these collections open to the public—transparency 
and accountability—few if any of the registries control the details they disclose or 
any subsequent uses made of the information. This has led to such abuses as bulk 
disclosures of personal information from the registries for marketing purposes. 


Parliament should amend the Privacy Act to permit disclosures of personal information 
from these registries only in ways and for purposes consistent with the original purpose 
for establishing the registry. 


Re-tooling the disclosure provisions 

Perhaps the most evident demonstration of the weakness of the current Privacy Act in 
dealing with disclosures of personal information was provided by the Federal Court 
of Appeal in 2000 in the E-311 case (Privacy Commissioner v. Attorney General of 
Canada).'The Court concluded that the disclosure provision in section 8(2)(b) of the 
Privacy Act enables Parliament to confer on any Minister (through a given statute) 
wide discretion to disclose information collected by the Minister’s department. 


The Privacy Commissioner argued that the Privacy Act required that the Minister 
disclose personal information only for the purpose for which it was collected, or for 
a use consistent with that purpose. However, the Court of Appeal found that section 
8(2)(b) of the Act did not impose any such limitation. The Supreme Court “agreed 
substantially” the following year. 
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The Privacy Act also sets out in subsection 8(2) specific circumstances in which 
government institutions may disclose personal information without the individual’s 
consent. Among these are disclosures to named investigative bodies, to Public 
Archives, to MPs to help constituents, to provincial and foreign governments, and for 
research and statistical purposes. 


Some of these disclosures seem too permissive; for example, section 8(2)(f) authorizes 
disclosures under an agreement or arrangement between the Government of Canada 
and the government of a province or a foreign state. This provision needs to be much 
more specific as to the parameters of any such sharing and provide guidance on the 
kinds of contract provisions that are needed to safeguard privacy. 


When Canadians share their information with the Canadian government at home 
or in consulates abroad, they do so with the expectation that this information will 
not generally make its way into the hands of foreign states. The current wording 
of section 8(2)(f) is broad and leaves much discretion to departments. There 
should be an obligation to thoroughly examine why the information is required 
by the foreign state, how it will be used, on what authority the request is made, 
and whether there are adequate safeguards to protect the information, including 
provisions protecting against secondary release. Pending reform of the Privacy Act, 
the Privacy Commissioner is actively encouraging government institutions to self- 
impose higher standards. 


After more than 20 years overseeing the Privacy Acts administration, it is evident to 
us that the disclosure provisions need review and substantial revision. 


Enabling the Privacy Commissioner 

Moving from the pure “ombudsman” role 

The Privacy Act gives the Privacy Commissioner of Canada the powers of an 
ombudsman, with no inherent powers of enforcement. The Privacy Commissioner 
can, however, go to Federal Court in certain circumstances. While the ombudsman 
model has been an effective one in avoiding an adversarial climate to encourage 
compliance, appeals to fairness and good sense are only as effective as the compliance 


they engender. 
Models in several other jurisdictions, both in Canada and abroad, give the overseer 


the tools to compel respect for the law. Parliament may wish to review the merits of 
such powers for the Privacy Commissioner of Canada. 
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Conducting research and public education 

For years, succeeding Privacy Commissioners have argued that the burgeoning 
threats to Canadians’ privacy warrant an informed and effective voice for privacy. The 
Commissioner’s Office needs both the power and the resources to conduct research 
and prepare reports on privacy issues, educate the public about their privacy rights, 
and evaluate the privacy implications of proposed legislation. 


While Parliament heard the pleas during drafting of PIPEDA—and how valuable the 
tools have proven to be—the Commissioner has not been given the same mandate 
for public education under to the Privacy Act. The Commissioner should be equally 
empowered to sensitize business, government and the public under both laws. 


Strengthening Court Review 

Finally, complainants—and the Privacy Commissioner—may only seek a Court 
review of, and remedies for, denials of access to their personal information. Effectively 
this means that allegations of improper collection, use and disclosure may not be 
challenged before the Court, and the subsequent benefit of the Court’s guidance on 
all government institutions is lost. Nor does the Privacy Act contemplate remedies for 
any damages caused by government actions. 


Even when the Commissioner agrees that the complaint has merit, the Federal Court 
decided in March 2005 (in Murdoch v. Canada (Royal Canadian Mounted Police)) that 
neither the Court nor the Privacy Commissioner has any powers beyond those set out 
in the Privacy Act. 


Individuals, or the Commissioner acting on their behalf, should be able to ask the 
Court to review government collection, use and disclosure of personal information. 
As well, the Commissioner, in his or her capacity as complainant, should be allowed 
to apply to the Court for review of any matter to which the Privacy Act applies. And 
the Court should be empowered to assess damages against offending institutions. 
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Building a Privacy Management Framework 
for the Federal Government 


What is a framework? 

Generally management frameworks serve as blueprints to help an institution achieve a 
desired result. They establish goals and policies, and describe the systems, procedures 
and performance measurements needed to meet those goals. Properly constructed and 
applied, frameworks can be powerful instruments for showing institutions how best 
to conduct an activity, and how to marshal and allocate resources to achieve results. 


While the concept is not new in management circles, applying it in the privacy context 
is. A government-wide model privacy management framework should be designed to 
help departments protect the personal information they control by identifying the 
inherent privacy risks, and how best to mitigate those risks. 


OPC interest in privacy management frameworks 
Our Office continually seeks improvements in the federal government’s privacy 
management. We do so assuming that: 


e The Privacy Act, (despite needed reform), should not inhibit improved privacy 
management; 
e Improvements can be achieved through policy and guidelines; and 
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e Treasury Board Secretariat (TBS), as the locus for privacy policy, should 
ensure that federal departments and agencies meet high privacy management 


standards. 


For example, in August 2004 our Office submitted a brief to the government on 
the implications of the USA PATRIOT Act. We suggested the federal government 
examine the circumstances under which it allows Canadians’ personal information to 
be processed outside of Canada—and thus beyond the protection of the Privacy Act. 


The Privacy Commissioner subsequently wrote to the President of Treasury Board 
requesting his support on this matter. 


In response, TBS began reviewing the federal government’s arrangements for 
outsourcing personal information. It also began developing model contractual clauses 
that departments could use to reduce the potential privacy risks to personal information 
being processed by U.S. companies or U.S. affiliates subject to the USA PATRIOT Act. 
This work is critically important and TBS expects to complete it shortly. 


Our Office also suggested TBS review the federal government’s data mining and 
assembly, re-examine the dated (1989) data matching policy, and strengthen the 
reporting requirements under the Privacy Act. These are also underway. We applaud the 
initiatives, as well as new privacy reporting requirements TBS issued in April 2005. 


On the face of it the reporting guidelines indicate a desire for stronger privacy 
management. After new guidelines have had a chance to work, our Office intends 
on examining privacy reporting in some depth to determine which annual reports 
and statistical data are most effective in explaining privacy activity and issues, and 
supporting sound privacy management. 


While each of these initiatives is significant, collectively they highlight the need for 
a more comprehensive and consistent approach to managing privacy in the federal 
government. A privacy management framework would help achieve this goal. 


What makes a good privacy management framework? 

First, TBS and departments—not our Office—are responsible for ensuring 
that an appropriate privacy management framework is in place. The design and 
implementation of frameworks need to be driven from within, not imposed 
externally. An external oversight body such as our Office certainly can, and should, 


28 


Privacy MANAGEMENT FRAMEWORK 


suggest the key attributes of an effective framework. We can also review and audit 
after the fact to determine whether a framework is working as intended. However, 
departmental ownership of the process is critical to its success. 


The idea of privacy management frameworks appears to be gaining momentum in 
the federal government. The Assistant Deputy Minister Privacy Committee (chaired 
by TBS, the department of Justice and the Privy Council Office) has met periodically 
to promote a coherent and effective federal approach to privacy which includes 
developing an overall privacy framework and the sharing of best practices. 


Some departments are already at work. For example, Human Resources and Skills 
Development Canada (HRSDC) presented their privacy management framework 
to the ADM Privacy Committee in June 2004. The department is a heavy user of 
personal data since it administers (among others) the Employment Insurance and 
Canada Student Loan programs. The framework aims to build trust with citizens by 
giving them more information about departmental programs and how they use and 
disclose individuals’ personal information. 


HRDSC defines the four pillars of their privacy management framework as: 


e strategic planning and governance—conducting research and analysis to better 
understand citizens expectations on privacy, and defining the core privacy 
principles for their operations; 


e risk management—establishing a review and approval protocol for privacy 
impact assessments, setting standards for personal information-sharing 
agreements and carrying out privacy reviews of research databases; 


e cultural change—providing training for all managers, staff and contractors on 
personal information management, including specialized training on the 
requirements of specific programs; and 


e assuring compliance—developing internal audit standards for managing 
personal information. 


HRSDC found that adopting a privacy management framework provided the 
department a renewed impetus for improving their personal information management. 
The framework established a common platform both for defining better privacy 
practices, and helping it take the initiative in identifying and resolving issues. We 
applaud the department's leadership and commitment to fair information practices. 
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With a little help from Privacy Impact Assessments 

Conducting privacy impact assessments (PIAs) provides another impetus for 
developing sound privacy management frameworks. Since May 2002, ‘Treasury 
Board policy requires federal departments and agencies to conduct PIAs for all new 
programs or services that raise potential privacy issues. The assessments are designed 
to forecast potential privacy problems and identify options to mitigate risks before 
beginning a project. 


The PIA policy is not only a key component of any good privacy management strategy; 
the policy itself promotes adopting a structure that is essentially a privacy management 
framework. The PIA policy guidelines, for example, require department heads to 
define the roles of their personnel in adhering to the requirements. Department heads 
must also assume responsibility for overseeing implementation—accountabilities that 
lie at the core of a privacy management framework. The policy also serves as an 
instrument for both promoting awareness of sound privacy practices, and measuring 
a department’s compliance with privacy best practices. 


The Treasury Board would be responsible for promulgating a model privacy 
management framework. A flexible approach should be taken in designing and 
applying a model. We recommend it possess the following attributes: 


e Communicates effectively the importance of personal information management 
and the commitment to building privacy into program management; 


e Sets clear objectives and standards on personal information gathering, quality, 
use, security, transmission, access, disclosure, retention and disposal; 


e Clarifies the roles and responsibilities, and provides a basis for determining 
the resources and skills needed for achieving sound privacy management; 


e Relies on sound risk management approaches, particularly through privacy 
impact assessments and/or threat risk assessments; 


e Uses effective controls to support compliance and best practices—integrating 
best available privacy-enhancing technology, resolving disputes effectively, 
and identifying and correcting system weakness or privacy incidents; and 


e Promotes accountability and continuous improvement through such means 
as reporting, audit and evaluation, education, and performance appraisals. 
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Since the concept is new, inevitably there will be some fine tuning—driven by 
experience and experimentation. In fact we are in the midst of a major audit that 
will allow us to test, refine and validate our approach. Once completed, we expect the 
audit will further substantiate the value of a privacy management framework. 


Privacy is, in many respects, a risk management issue. Privacy management frameworks 
are of vital importance in helping federal institutions manage that risk. Accordingly, we 
recommend that the TBS develop a model framework to guide privacy management 
in federal departments and agencies. 


We have discussed our recommendation for a model framework with TBS 
management. The President of the Treasury Board is committed to exploring the 
concept of a government-wide privacy management framework. We understand that 
TBS has begun examining both the scope and process for a project that should build 
on existing management frameworks. The project will require dedicated resources, 
cooperation among stakeholders (including our Office), effective communication 
with departments, and appropriate compliance mechanisms. 


We welcome the initiative. 
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Complaints 


Introduction 


he Privacy Act has been in force since 1983, protecting individuals’ personal 

information held by federal government departments and agencies. The Act 

governs those institutions’ collection, use, disclosure, retention and disposal of the 
personal information they hold to administer government programs. Individuals also 
have the right to request access to and correction of their government-held personal 
information. The Act also sets out the duties, responsibilities and mandate of the 
Privacy Commissioner of Canada. 


The Commissioner receives and investigates complaints from individuals who 
believe their Privacy Act rights have been violated. The Commissioner may initiate a 
complaint and investigate any situation where she has reasonable grounds to believe 
the Act has been violated. 


The Privacy Commissioner of Canada is an ombudsman who resolves complaints 
through mediation, negotiation, and persuasion whenever possible. However, the Act 
gives the Commissioner broad investigative powers to carry out her mandate. She 
may subpoena witnesses, compel testimony, and enter premises to obtain documents 
or to conduct interviews. It is an offence under the Act to obstruct an investigation. 


The Act does not grant the Commissioner order-making powers. Nevertheless, the 
Commissioner can and does recommend necessary changes to the information- 
handling practices of government institutions. The Commissioner may audit any 
federal department or agency at any time, and may recommend changes to any 
practices that are not in compliance with the Privacy Act. 
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The Commissioner is required to submit an Annual Report to Parliament, detailing 
the activities of the Office in the previous fiscal year. This report covers the period 
from April 1, 2004 to March 31, 2005 for the Privacy Act. 


Investigations and Inquiries 


ComplaintsReceived pose: Be 


The Office received 1,577 complaints under the Privacy Act in 2004-05, down from 
4,206 in 2003-04. While this is a significant decrease, the 2003-04 volume was an 
all-time high due to specific circumstances: almost 500 aboriginal Canadians filed 
complaints against a Health Canada consent form; and correctional officers, staff and 
inmates filed more than 2000 complaints against Correctional Service Canada. This 
year’s volume is a return to a more normal year. 


Definitions of Complaint Types 
Complaints received in the Office are categorized into three main groups: 


Access: 


e Access. All personal information has not been received, either because 
some documents or information are missing or the institution has applied 
exemptions to withhold information. 


e Correction/Notation. The institution has failed to correct personal 
information or has not placed a notation on the file in the instances 
where it disagrees with the requested correction. 


e Language. Personal information was not provided in the official language 
of choice. 


e Fee. Fees have been assessed to file a Privacy Act request; there are presently 
no fees prescribed for obtaining personal information. 


e Index. INFOSOURCE! does not adequately describe the personal 


information holdings of an institution. 


" INFOSOURCE is a federal government directory that describes each institution and the banks of 


information (group of files on the same subject) held by that particular institution. 
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Privacy: 


CompPLaInts 


Collection. Personal information collected that is not required for an 
operating program or activity of the institution; personal information is 
not collected directly from the individual concerned; or the individual is 
not advised of the purpose of the collection of personal information. 


Retention and Disposal. Personal information is not kept in accordance with 
retention and disposal schedules (approved by the National Archives and 


published in INFOSOURCE’): either destroyed too soon or kept too 
long. 


In addition, personal information used for an administrative purpose 
must be kept for at least two years after the last administrative action 
unless the individual consents to its disposal. 


Use and Disclosure. Personal information is used or disclosed without the 
consent of the individual and does not meet one of the permissible 
disclosures without consent listed in section 8(2) of the Act. 


Time Limits: 


Time Limits. The institution did not respond within the statutory limits. 


Extension Notice. The institution did not provide an appropriate rationale 
for an extension, applied for the extension after the initial 30 days had 
been exceeded, or applied a due date more than 60 days from date of 
receipt. 


Correction/Notation Time Limit. The institution has failed to correct personal 
information or has not placed a notation on the file within 30 days of 
receipt of a request for correction. 
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COMPLAINTS RECEIVED BY COMPLAINT TYPE 


Received between April 1, 2004 and March 31, 2005 


This table shows the number of complaints received by Complaint Type. 


Complaint Type Total Percentage 
Access 604 38% 
Correction-Notation 29 2% 
Language 2 0% 
Collection 92 6% 
Retention and Disposal ig 1% 
Use and Disclosure 250 16% 
Time Limits 489 31% 
Extension Notice 90 6% 
Correction-Time Limits 4 0% 
Total 1,577 100% 


TOP TEN DEPARTMENTS BY COMPLAINTS RECEIVED 


Year ending March 31, 2005 


This table represents the departments that received the greatest number of complaints in the 
reporting period. 


It should be noted that this does not necessarily mean that these departments are exercising poor 
compliance with the Privacy Act. Rather, some of these departments because of their mandate hold a 
substantial amount of personal information about individuals and are therefore more likely to receive 
numerous requests for access to that information. A large amount of personal information increases 
the likelihood of complaints about the department's collection, use and disclosure, retention and 
disposal of personal information, and the manner in which it provides access to that information. 


Institution Total Access’ Time Privacy 

Correctional Service of Canada 395 162 84 149 
Immigration and Refugee Board 222 96 126 0 
Canada Revenue Agency 183 69 64 50 
Royal Canadian Mounted Police 155 58 67 30 
Citizenship and Immigration Canada 118 39 72 7 
National Defence 72 25 34 13 
Canada Post Corporation 60 ee: 1 af 
Canadian Security Intelligence Service 49 46 2 1 
National Research Council Canada 47 0 46 1 
Justice Canada 32 14 17 1 
Others 244 94 70 80 
Total 1,577 635 583 359 


Comptaints 


COMPLAINTS RECEIVED BY RESPONDENT 


Received between April 1, 2004 and March 31, 2005 


This table shows the actual number of all of the complaints lodged against the various departments 
and agencies that were received in the reporting period. 


Institution Total 

Agriculture and Agri-Food Canada 2 
Atlantic Canada Opportunities Agency 1 
Bank of Canada 1 
Canada Border Services Agency 26 
Canada Customs and Revenue Agency 6 
Canada Post Corporation 60 
Canada Revenue Agency 183 
Canada School for Public Service 1 
Canadian Firearms Centre 1 
Canadian Food Inspection Agency 2 
Canadian Human Rights Commission 3 
Canadian Nuclear Safety Commission 1 
Canadian Security Intelligence Service 49 
Citizenship and Immigration Canada 118 
Commission for Public Complaints Against the RCMP 3 
Correctional Investigator Canada 2 
Correctional Service Canada * 395 
Elections Canada 1 
Environment Canada 4 
Farm Credit Canada 1 
Financial Transactions and Reports Analysis Centre of Canada 1 
Fisheries and Oceans 8 
Foreign Affairs and International Trade Canada 24 
Health Canada 27 
Human Resources and Skills Development Canada 41 
Immigration and Refugee Board ** 222 
Indian and Northern Affairs Canada 4 
Industry Canada 3 
Justice Canada, Department of 32 
Military Police Complaints Commission 1 
National Archives of Canada 3 
National Capital Commission 5 
National Defence 72 
National Gallery of Canada 2 
National Parole Board 10 
National Research Council Canada 47 


* CSC - A large portion of these complaints were submitted by Correctional Officers in the course 
of their labour relations negotiations with their employer. 

** IRB - A significant portion of these complaints were submitted by one individual in the course of 
dealing with the IRB. 
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COMPLAINTS RECEIVED BY RESPONDENT (cont.) 


Received between April 1, 2004 and March 31, 2005 


This table shows the actual number of all of the complaints lodged against the various departments 
and agencies that were received in the reporting period. 


Natural Resources Canada 

Natural Sciences and Engineering Research Council of Canada 
Office of the Chief Electoral Officer 

Privy Council Office 

Public Service Commission Canada 

Public Service Human Resources Management Agency of Canada 
Public Service Staff Relations Board 

Public Works and Government Services Canada 

Royal Canadian Mounted Police *** 

Social Development Canada 

Statistics Canada 

Transport Canada 

Veterans Affairs Canada 

Western Economic Diversification Canada, Department of 

Total 1,57 
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*** RCMP - A great number of these complaints are time related complaints since the RCMP was not 
able to respond to requests within the legislated time frames imposed by the Act. 


ComplaintsCompleted = 


We closed 2,407 complaints under the Privacy Act, over 800 more than our Office 
received in the year. However, almost 1,000 of those complaints were from one group 
of individuals—correctional officers requesting copies of their employee personnel files. 
Since many were similar, they required less work than would 1,000 unique complaints 
(once one complaint is concluded, the documentation serves as a model for many 
others). Nevertheless, the investigators accomplished a formidable task in closing 
so many cases, particularly since there were fewer staff than in previous years and 
investigators were diverted on a rotational basis to help the Inquiries Unit. 


Despite closing more Privacy Act complaints than it received, the Office is carrying a 
significant number of ongoing cases—1,277 at fiscal year end. Resource levels were not 
sufficient to keep up with demand. Year end saw the final stages of a major Business 
Process Review of the Investigations and Inquiries Branch which was undertaken to 
streamline processes wherever possible, help establish appropriate resource levels, and 
solve our ever-growing aging caseloads. 


CompLaints 


Normally we would expect to close approximately 1,185 complaints with the allocated 
staff. With an annual intake in excess of 1,500, we are losing ground; the caseload is 
aging and by fiscal year-end 577 complaints remained unassigned due to lack of staff. 
We have limited open caseloads to 35 per investigator at a time. Some of the unassigned 
cases are now nearly a year old. Even older complaints being actively investigated take 
more time as the delay becomes a factor in finding documents and dealing with fading 
memories. The Branch’s established standard of investigators completing 75 cases 
each year means that it would take approximately eight investigators one year to clear 
the unassigned cases alone. 


Definitions of Findings under the PrivacyAct 


The Office has developed a series of definitions of findings to explain the outcome of 
its investigations under the Privacy Act. 


Not Well-founded: the investigation uncovered no or insufficient evidence to conclude 


that the government institution violated the complainant’s rights under the Privacy 
Act. 


Well-founded: the government institution failed to respect the Privacy Act rights of an 
individual. 


Well-founded/Resolved: the investigation substantiated the allegations and the 
government institution has agreed to take corrective measures to rectify the problem. 


Resolved: after a thorough investigation, the Office helped negotiate a solution 
that satisfies all parties. The finding is used for those complaints in which “well- 
founded” would be too harsh to fit what essentially is a miscommunication or 
misunderstanding. 


Settled during the course of the investigation: the Office helped negotiate a solution that 
satisfies all parties during the investigation, but issues no finding. 


Discontinued: the investigation was terminated before all the allegations were fully 
investigated. A case may be discontinued for any number of reasons —the complainant 
may no longer be interested in pursuing the matter or cannot be located to provide 
additional information critical to reaching a conclusion. 


Early resolution: applied to situations in which the issue is dealt with before a formal 
investigation is undertaken. For example, if an individual complains about an issue 
that the Office has already investigated and found to be compliant with the Privacy 
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Act, we explain this to the individual. We also receive complaints in which a formal 
investigation could have adverse implications for the individual. We discuss the 
possible impact at length with the individual and should he or she choose not to 
proceed further, the file is closed as “early resolution”. This is a new type of disposition 
which the Office began using in April 2004. 


COMPLAINT FINDINGS BY COMPLAINT TYPE 


Closed between April 1, 2004 and March 31, 2005 


This table clearly shows the total number of the various findings issued by the Office by complaint 
type in the reporting period. 


Discontinued Early Notwell- Resolved Settledduring Well-  Well- Total Percentage 
Resolution founded investigation founded founded- 
Resolved 

Access 44 JO AAV ADE 18 120 21 21 1,416 59% 
Correction- 1 0 5 0 3 0 0 9 0% 
Notation 
Language 1 0 0 1 0 0 0 2 0% 
Collection 3 11 32 2 12 6 0 66 3% 
Retention & 0 2 7 0 2 2 1 14 1% 
Disposal 
Use & 29 43 143 1 63 138 1 418 17% 
Disclosure 
Time Limits 15 9 42 0 Syn okalles 0 432 18% 
Extension 1 0 14 0 0 23 0 38 2% 
Notice 
Correction- 1 0 0 0 0 11 0 12 0% 
Time Limits 
Total 95 87 —- 1,413 22 205 562 23 2,407 100% 
(#and %) (4%) (4%) (59%) (1%) (8%) (23%) (1%) 


* As mentioned previously a large portion of the complaints determined to be not well-founded 
were submitted by the Correctional Officers in CSC who invoked the access provisions of the 
Act and its subsequent complaints mechanism in the course of their on-going labour dispute with 
CSC. In these cases CSC had decided to provide the Correctional Officers with their personal 
information by using a particular method of access to which the Correctional Officers objected. 
Our subsequent investigation of these complaints determined that CSC had the authority to 
choose the method of access and that it was compliant with the Privacy Act in doing so. 

** A large number of time limit complaints were lodged against some departments that are 

facing significant resourcing problems. While we can sympathize, the Privacy Act simply 

does not provide this Office with any flexibility about refusing to investigate these complaints. 

Departments and agencies are required to respond to each and every privacy request and our 

role is to see that departments properly apply the Privacy Act. Having said this we are aware that 

some institutions are addressing their resourcing issues and commend them for dealing with 
their problem. We look forward to seeing the impact that these new resources will have on the 
number of complaints and will report on this issue in the next annual report. 
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COMPLETED COMPLAINTS BY ORIGIN ; 


Closed between April 1, 2004 and March 31, 2005 


This table shows the province of origin of the complaints investigated in the reporting period. It is to 
be noted that some complaints were received from some persons living outside of Canada. 


Province/Territory Total 
Quebec 1,090* 
Ontario 641* 
British Columbia 274 
NCR (ON) 106 
Alberta 81 
New Brunswick 59 
Saskatchewan 40 
NCR (QC) 39 
Manitoba 34 
Nova Scotia 17 
Prince Edward Island 6 
International 6 
Newfoundland and Labrador 5 
Northwest Territories 3 
Nunavut 3 
Yukon Territory a 
Total 2,407 


* A significant portion of both these figures is attributable to the complaints lodged by the 
Correctional Officers in CSC. 
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COMPLETED COMPLAINTS AND RESULTS BY RESPONDENT 


Closed between April 1, 2004 and March 31, 2005 


This table shows the number of completed complaints by respondent and by finding. 


Respondent Discontinued Early = Notwell Resolved _— Settled Well- Well- _— Total 
Resolution founded during founded founded 
investigation Resolved 
Agriculture & Agri-food Canada 0 0 2 0 1 0 0 3 
Auditor General of Canada, 0 0 1 0 0 0 0 1 
Office of the 
Business Development Bank of 0 0 0 0 1 0 0 1 
Canada 
Canada Border Services Agency 0 7 0 0 0 2 0 9 
Canada Customs & Revenue 28 2 56 3 28 16 3 136 
Agency 
Canada Mortgage & Housing 0 0 0 0 0 0 1 1 
Corporation 
Canada Post Corporation 5 29 0 12 37 3 95 
Canada Revenue Agency 2 11 4) 3 2 26 0 85 
Canadian Firearms Centre 1 1 0 0 0 0 0 2 
Canadian Food Inspection Agency 0 1 0 0 1 1 0 3 
Canadian Heritage 0 0 1 0 0 0 0 1 
Canadian Human Rights 0 0 0 ] 0 1 0 2 
Commission 
Canadian Museum of Civilization 0 1 0 0 0 0 0 1 
Canadian Security Intelligence 1 0 16 0 9 1 0 27 
Service 
Canadian Space Agency 0 0 1 0 0 0 0 1 
Canadian Tourism Commission 0 0 0 0 0 3 1 4 
Citizenship & Immigration 6 7 26 0 22 52 ) 115 
Canada 
Commission for Public Complaints 0 0 1 0 0 2 0 3 
Against the RCMP 
Correctional Investigator Canada 0 2 0 0 1 1 4 
Correctional Service Canada 12 20) is Ad 22) 25 54 305 2 1,510 
EDULINX Canada Corporation 0 1 0 0 0 0 0 1 
Environment Canada 0 0 1 0 0 0 0 1 
Finance Canada, Department of 0 0 0 0 0 0 1 1 
Financial Transactions & Reports 0 0 1 0 0 1 0 2 
Analysis Centre of Canada 
Fisheries & Oceans 0 0 4 0 0 0 1 5 
Foreign Affairs & International 0 1 5 0 3 9 0 18 
Trade Canada 
Health Canada 1 0 2 1 2 6 1 13 


* 


This figure clearly shows that CSC had appropriately responded to the large number of access 
requests it had received from its Correctional Officers and that it was compliant with the 
requirements of the Act. 
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COMPLETED COMPLAINTS AND RESULTS BY RESPONDENT (cont.) 
Closed between April 1, 2004 and March 31, 2005 


This table shows the number of completed complaints by respondent and by finding. 


Respondent Discontinued Early §Notwell Resolved _ Settled Weil- Well- _—Total 
Resolution founded during founded founded 
investigation Resolved 
Human Resources & Skills 12 9 26 1 8 6 3 65 
Development Canada 
Immigration & Refugee Board 0 0 4 0 6 2 0 12 
Indian & Northern Affairs Canada 0 1 0 0 5 0 0 6 
Industry Canada 0 0 1 1 1 0 0 3 
Justice Canada, Department of 1 2 3 1 3 7 0 17 
National Archives of Canada 0 0 2 0 0 0 0 2 
National Capital Commission 0 1 0 0 0 0 0 1 
National Defence 5 4 10 4 15 33 0 71 
National Gallery of Canada 0 0 0 0 1 0 0 1 
National Parole Board 1 0 15 0 1 | 0 18 
National Research Council Canada 0 0 0 0 1 0 0 1 
Ombudsman National Defence & 0 0 0 0 0 0 1 1 
Canadian Forces 
Pension Appeals Board Canada 0 0 0 0 1 0 0 1 
Privy Council Office 0 0 0 0 0 1 0 1 
Public Service Commission 0 1 3 0 0 0 0 4 
Canada 
Public Works & Government 0 0 2 0 4 0 i 7 
Services Canada 
Royal Canadian Mint 0 0 1 0 0 0 0 1 
Royal Canadian Mounted Police 15 5 33 | 19 43 1 117 
Social Development Canada 0 0 1 0 3 2 0 6 
Solicitor General Canada 0 0 0 0 0 2 0 2 
Statistics Canada 1 1 2 0 0 0 0 4 
Status of Women Canada 0 0 2 0 0 0 0 2 
Transport Canada 0 1 4 1 2 2 1 11 
Veterans Affairs Canada ] ] 3 0 0 0 0 5 
Western Economic Diversification 3 0 0 0 0 0 0 3 
Canada, Department of 
Total 95 87 1,413 22 205 562 23 ~—-2,407 
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Investigation Process under the PrivacyAct === 


Inquiry: 
Individual contacts OPC by letter, by telephone, or in person to complain of violation of the Act. Individuals who make contact in 
person or by telephone must subsequently submit their allegations in writing. 


+ 


Initial analysis: 
Inquiries staff review the matter to determine whether it constitutes a complaint, i.e., whether the allegations could constitute a 
contravention of the Act. 


An individual may complain about any matter specified in section 29 of the Privacy Act — for example, denial of access, or 
unacceptable delay in providing access, to his or her personal information held by an institution; improper collection, use or 
disclosure of personal information; or inaccuracies in personal information used or disclosed by an institution. 


v 
aes Complaint? oil 
No: Yes: 
The individual is advised, for example, that the matter is An investigator is assigned to the case. 


not in our jurisdiction. 


Investigation: 
The investigation will serve to establish whether individuals’ privacy rights have been 
contravened or whether individuals have been given their right of access to their personal 
information. 


Early resolution? 
A complaint may be resolved 
before an investigation is 
undertaken if, for example, the 


1 
1 
1 
: 
i 
1 
issue has already been full 
y y ; The investigator writes to the institution, outlining the substance of the complaint. The 
; 
i] 
1 
1 
i] 


investigator gathers the facts related to the complaint through representations from 
both parties and through independent inquiry, interviews of witnesses, and review of 
documentation. Through the Privacy Commissioner or her delegate, the investigator has 
Lag aaa a 3 the authority to receive evidence, enter premises where appropriate, and examine or 
obtain copies of records found on any premises. 


of egies gece eg tae | 
assessed a . 


Discontinued? | Analysis (on next page) 
A complaint may be 
discontinued if, for 1 
example, a complainant ; 
1 
! 
i] 
i] 


dealt with in another complaint 
and the institution has ceased 
the practice. 


decides not to pursue it, 
ora complainant cannot 
be located. 


Settled? (on next page) 
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Analysis: 
The investigator analyzes the facts and prepares recommendations to the Privacy Commissioner or her 
delegate. The investigator will contact the parties and review the facts gathered during the course of the 
investigation. The investigator will also tell the parties what he or she will be recommending, based on the 
facts, to the Privacy Commissioner or her delegate. At this point, the parties may make further representations, 


Analysis will include internal consultations with, for example, Legal Services or Research and Policy Branches, 
as appropriate. 


v 
; Findings: 
; The Privacy Commissioner or her delegate reviews the file and assesses the report. The Privacy 
Sine WIR. ~ __ Commissioner or her delegate, not the investigator, decides what the appropriate outcome should be and 
whether recommendations to the institution are warranted. 
Settled? | 
The OPCseeksto | The Privacy Commissioner or her delegate sends letters of findings to the parties, The letters outline 
resolve complaints the basis of the complaint, the relevant findings of fact, the analysis, and any recommendations to the 
and to prevent i __ institution. The Privacy Commissioner or her delegate may ask the institution to respond in writing, within 
contraventions | aparticular timeframe, outlining its plans for implementing any recommendations. 
from recurring. ; 
: The possible findings are: 
The Commissioner : : 
encourages 1 Not Well-Founded: The evidence, on balance, does not lead the Privacy Commissioner or her delegate to 
resolution through , conclude that the complainant's rights under the Act have been contravened. 
woes 1 
eee ands Well-Founded: The institution failed to respect a provision of the Act. 
persuasion. The | 
investigator assists ' Well-Founded, Resolved: The investigation substantiated the allegations and the institution has agreed 
in this process, | to take corrective measures to rectify the problem. 
@ i] 
eee Sa + Resolved: The evidence gathered in the investigation supports the allegations raised in the complaint, but 


the institution agreed to take corrective measures to rectify the problem, to the satisfaction of this Office. 
The finding is used for those complaints in which Well-Founded would be too harsh to fit what essentially is 
a miscommunication or misunderstanding. 


In the letter of findings, the Privacy Commissioner or her delegate informs the complainant of his or her 
rights of recourse to the Federal Court on matters of denial of access to personal information. 


| Where recommendations have 
been made to an institution, OPC 
1 Staff will follow up to verify that 
they have been implemented. 


The complainant or the Privacy Commissioner may choose to apply to the 
Federal Court for a hearing of the denial of access. The Federal Court has the 
power to review the matter and determine whether the institution must 
provide the information to the requester. 


Note: a broken line (- - - - ) indicates a possible outcome. 


a a EEeee 


45 


Annuat Report To Partiament 2004-2005 - Report on THE Privacy Act 


COMPLAINT INVESTIGATIONS TREATMENT TIMES - PRIVACY ACT 


Thistable represents the average number of months ithas taken tocompleteacomplaint investigation 
by disposition, from the date the complaint is received to when a finding is made. 


By Disposition 
For the period between April 1, 2004 and March 31, 2005. 
Disposition Average Treatment Time in Months 

Early Resolution Pay) 
Well-Founded 6.1 
Not Well-Founded 6.1 
Discontinued 6.7 
Settled in the Course of Investigation 10.1 
Well-Founded, Resolved £5 
Resolved 12.0 
Overall Average 6.4 


By Complaint Type 
For the period between April 1, 2004 and March 31, 2005. 


This table represents the average number of monthsit has taken to complete a complaint investigation 
by complaint type, from the date the complaint is received to when a finding is made. 


Complaint Type Average Treatment Time in Months 

Correction/Notation Time Limit 4.1 

Extension Notice 4.4 
Time Limits 5.6 
Access 6.3 

Use and Disclosure yee 

Collection 9.4 
Retention and Disposal 10.0 
Correction/Notation 10.7 
Overall Average 6.4 


Upon reviewing this table, one can see that the less complex complaints (Time Limits and 
Extension Notice) were completed in a shorter period of time than the more complex ones. This 
is reasonable since the more complex complaints usually require more on-site interviews, more in- 
depth research and analysis and, often times, lengthier negotiations with an institution regarding 
proposed corrective measures when there has been a breach of the Act. 
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Follow-up after Investigations 

Once a complaint is investigated and completed, the story does not necessarily end 
there. All complaints dealing with improper collection, use, disclosure and retention 
that are well-founded are sent to the Audit and Review Branch for its review. This 
allows the Branch to identify any trends and patterns dealing with privacy breaches 
and use this information in planning and developing its audits for the next year. 


Selectcasesunderthe PrivacyAct = 


The cases described below have been selected for their educational value. They 
demonstrate the importance of correctly handling personal information and what 
can go wrong if this does not occur. It is hoped that they will encourage government 
institutions and agencies to be ever vigilant in handling personal information in 
accordance with the Act and to engage in ongoing staff education in that regard. 
At the same time, members of the general public may be prompted to ask questions 
about how their personal information is being handled by federal institutions and 
know that they can complain to this Office should something go wrong. 


Outside psychologist’s notes still “under control of” RCMP 


An RCMP member, under investigation for allegedly uttering threats and 
unlawful use of a firearm, complained that the force denied her access to 
information gathered during its investigation. She did not receive a copy of a 
videotaped interview or the notes and psychometric data from interviews with 
a psychologist. 


The privacy investigator determined that some of the information she sought in the 
videotaped interview with an RCMP investigator contained information about other 
people—an exemption under the Privacy Act. The force was able to remove these 
segments and provide her with the remaining information. 


More problematic were the psychologist’s records. The RCMP did not have copies 
of the material since the services were provided, not by a staff member, but by an 
outside professional on a fee for service basis. Pressed by the investigator, RCMP 
staff obtained some of the information but the psychologist refused to provide the 
psychometric data and what he termed his “personal notes” unless served with a court 
order. He argued that disclosing the material would breach his profession's ethical 
standards. 
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The RCMP’s attempts at persuasion yielded nothing until the OPC wrote formally 
to the former Commissioner advising him that since the RCMP had hired the 
psychologist to assess the member, all the information prepared or created for the 
assessment was “under the control of” the RCMP for Privacy Act purposes. The 
psychologist eventually provided his notes, as well as the psychometric data which the 
RCMP sent to the complainant’s doctor for explanation and interpretation. 


Our Office concluded that the complainant eventually received the appropriate 
information but her complaint was well-founded. We reminded the RCMP that 
personal information collected on its behalf by outside experts is still under its control 
and thus subject to individuals’ access. Contracts should make this clear. 


Tax information disclosure narrower than it appears 


A man complained that he was being forced to provide his province's drug 
insurance program with his income tax information before receiving the 
benefits. 


This is a provincial drug insurance program providing financial assistance to residents 
who need help paying for prescription drugs. The program’s level of assistance is 
tied to the family’s net income—the less you earn, the more help you receive. Not 
surprisingly, the program verifies applicants’ income by seeking their consent for the 
Canada Revenue Agency (CRA) to release their income information to the insurance 
program. 


However, the consent form is very broad and appears to allow the program to see 
virtually all an individual’s tax return. The privacy investigator followed up with 
CRA’s Federal and Provincial Affairs Division. Staff explained that the breadth of the 
consent was dictated by the wording contained in the Memorandum of Understanding 
(MOU) with Ministry of Health. The key words in the consent form are “relevant 


to and solely for the purpose of determining, verifying and administering my level of 
benefit...” 


To determine just what information meets those criteria, the privacy investigator 
examined the MOU and confirmed that CRA provides only three income amounts 
to the program: lines 236—Net Income; 303—Married Amount, and 5105—Net 
Income of Spouse as Reported Under GST Credit. 
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The complainant was satisfied with the investigator’s findings and appreciative of the 
Office's efforts to determine how the program worked. He did not need any further 
action and the complaint was considered settled in the course of investigation. 


Offender given caregiver's personal information 


A woman complained that Correctional Service Canada (CSC) gave extensive 
personal information about her to an offender for whom she was caring. 


The woman provides palliative care in her home to the elderly and those with special 
needs. CSC assessed the complainant to determine whether the home would be 
an appropriate facility in which to place offenders with special needs. CSC visited 
her home, conducted a full interview, prepared a Private Home Placement Report 
and approved the facility. The individual subsequently agreed to take in an offender 
whom the National Parole Board (NPB) had granted day parole. The offender 
needed placement in a facility capable of handling his extensive physical and mental 
conditions while also meeting the conditions of his parole. CSC considered him an 
unrepentant child molester and at danger of re-offending. 


Once the offender was approved to move into the woman’s care, he wrote to her 
saying that he had seen “your report from NPB” and that he understood her problems. 
The day after he moved into her home, he produced his address book in which he 
had written the names and telephone numbers of two of the woman's references to 
CSC. He also produced an entire copy of the Private Home Placement Report — a 
document the woman had never seen. The report included information about the 
woman's family members including information about her childhood, her marital 
history and current status, and educational and employment history. 


The complainant was shaken by the offender’s revelations and got in touch with local 
CSC parole officials. They agreed to her removing the report from the offender's 
room and blacking out her references’ names and telephone numbers from his address 


book. 


The investigation revealed that CSC officials originally intended releasing the offender 
to another facility but had to change plans. They then had to seek the NPB’s approval 
to change the release destination. The offender's particular situation and his required 
level of care prompted Parole Board members to ask for more information about the 
private home placement. CSC provided the Placement Report to the Parole Board; 
it was then given to the board members who subsequently approved the change of 
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destination. The investigator was satisfied that the offender had not disclosed the 
information to anyone else. 


At issue was whether CSC contravened the Privacy Act by giving the report to the 
offender. The Corrections and Conditional Release Act (CCRA) requires the Parole 
Board to share with the offender the information it uses to reach a decision about 
him or her. However, the information can be in the form of a summary or the “gist” 
of the information. The CCRA also allows the Parole Board to withhold “as much 
information as strictly necessary” (Section 144(4)) if the disclosure could jeopardize 
someone’s safety, the security of a correctional institution, or the conduct of a lawful 


investigation. 


It was evident from the investigation that only the Parole Board members who were 
deciding on the application had actually read the Placement Report. No-one else 
at the NPB had read the full report and so none knew the extent of the personal 
details it contained. The NPB contended that CSC was responsible for ensuring that 
information was lawfully shared with the offender. NPB officials were also adamant 
that the law’s requirements would have been fully met had CSC given the offender 
only the “gist” of the report. Unfortunately no one at CSC had read the report before 
giving it to the offender so they too were unaware of its contents. 


The OPC found the case extremely disturbing, given the offender’s history, the nature 
of the information in the report, and the fact that he was residing in her home. We 
understood that NPB and CSC officials were under time constraints to place the 
offender as quickly as possible and there was no malicious motive for the disclosure. 
Nevertheless, we found it disconcerting that the woman’s personal information was 
disclosed simply because no one took the time to read the report. The disclosure 
should never have happened. The Privacy Act has been in force since 1983 and 
federal government employees are constantly reminded of their obligations to protect 
personal information. 


Our Office concluded that CSC had seriously contravened the woman’s confidentiality 
rights and that the complaint was well-founded. Unfortunately the Privacy Act 
provides no remedies or grounds for court review in the case of an improper disclosure 
of personal information. 


The case has led to an agreement that CSC will no longer provide Placement Reports 
to the NPB. 
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Expired passports insufficient identification—for a passport 


A man trying to renew his passport to attend a conference in Sweden 
questioned: 


+ Why he had to provide additional identifying information; 


+ Why an expired passport was not sufficient identification even though it 
was provided by a competent federal authority; and 


+ In what circumstances the Passport Office could refuse a document issued 
by a competent federal authority. 


The complainant was opposed to providing a health card, firearms permit or driver's 
licence as proof of identity, arguing that Canadians are under no legal obligation 
to hold any of these documents and requiring any of them was both a violation of 
the Charter and the Privacy Act. The man also objected to providing his employer’s 
address or that of any educational institution he attended in the past two years since 
either requirement would effectively preclude retired or unemployed persons from 
obtaining a passport. 


Finally the man claimed that the Passport Office’s demand for at least two references 
from people other than family members made it difficult for those, like himself, 
whose ill health or physical disability limits their contacts. He also argued that family 


members should not be automatically excluded as references. 


The privacy investigator met Passport Office staff to review the requirements. The 
power to issue a passport comes from exercising Royal Prerogative not a particular 
law. The Passport Office (a Special Operating Agency of the Department of Foreign 
Affairs and International Trade), collects the passport information under the authority 
of an Order in Council Canadian Passport Order which gives the Minister the power 
to prescribe which forms will be used before issuing the passport. A third page was 
added to the application following September 11, 2001 to satisfy the department's 
concerns that the process was secure. The third page asks for addresses during the 
preceding two years, as well as for references. 


Since a passport establishes the identity and citizenship of the bearer abroad, its validity 
is heavily dependent on the accuracy of the applicant’s statements. Confirming the 
information with references who have known the applicant for at least two years helps 
substantiate its accuracy. However, applicants who cannot provide such references can 
complete form PPT 132-Declaration in lieu of guarantor and may also be able to name 
a family member in some circumstances. 
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The Passport Office confirmed that it cannot accept either an expired passport or 
Canadian birth certificate as supplementary identification because both were issued 
under less rigorous rules and can be forged. The office now demands the additional 
information to support the accuracy of the applicant’s statements, and help avoid 
circulation of false passports. Applicants can use expired passports as proof of 
Canadian citizenship but not as a secondary piece of identification. 


Our Office concluded that the Passport Office has the legal authority to collect the 
additional information to confirm the applicant’s identity. The intent is not to impose 
draconian restrictions on applicants but to give the Passport Office confidence in the 


identity of the bearer and to help maintain the security of Canadian passports. 


The complaint was considered not well-founded. 


On-line security of taxpayers’ information 


A Chartered Accountant challenged the security of the Canada Revenue Agency 
(CRA)'s on-line system. She complained that the existing system could improperly 
disclose taxpayers’ information. Individual taxpayers do not have to ask for on- 
line access—it is available by default. She argued that CRA has put the onus on 
taxpayers to protect their information. Instead it should require taxpayers wanting 
on-line service to register, and should then enhance the security requirements. 


In October 2003 CRA introduced a program allowing taxpayers to access their 2001 
and 2002 tax information via the “My Account” section of CRA’s Web site at www. 
cra-arc.gc.ca. To gain access, taxpayers have to supply their Social Insurance Number, 
date of birth, amount of income reported on line 150, and their eight-digit access 
code from their Notice of Assessment. Taxpayers can block on-line access to their 
information by getting in touch with CRA’s e-help desk at the toll free number 
provided. 


CRA also protects the information with encryption technology and security 
procedures. Taxpayers wanting to use the service must first install a secure browser 
which requires the taxpayer to use a personally assigned password. 


The accountant also pointed out that with the exception of the date of birth, all the 


information required for on-line access is printed on the Notice of Assessment. Since 
taxpayers are frequently asked to provide the notices as proof of income by lenders, 
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credit card providers, financial advisors and other institutions, anyone with a copy 
could access the taxpayer’s file. The complainant had no evidence of any unauthorized 
access. 


The OPC concluded that CRA’s security measures are sufficient to protect taxpayers’ 
information in the system and the complaint was not well-founded. Also the Income 
Tax Act requires CRA to provide taxpayers with a Notice of Assessment. Once 
taxpayers receive the notice, the onus is on them to protect the information. 


Creating Travel Profiles for Public Servants 


A government employee complained about the amount of personal information 
that Public Works and Government Services Canada (PWGSC) collects in the 
Traveller Profile form. 


The federal government has completely reorganized its method of arranging employees’ 
travel. It created a Government Travel Modernization Office which subsequently 
awarded a contract to Accenture to deliver all government travel services. Accenture 
then subcontracted credit cards and travel services to American Express. 


Government employees must now make all travel arrangements through Travel 
AcXess Voyage. But they must first complete a Traveller Profile in order to obtain the 
required Travel Identification Number before making any travel arrangements. The 
profile is sent to the credit card company, which then issues the number. 


The information required included employees’ group and subgroup, level, travellers’ 
home telephone numbers and home addresses, emergency contact names, and dates 
of birth. The investigator reviewed the form and met PWGSC staff to determine 
why employees had to provide each of the details. The investigator also reviewed a 
PWGSC document explaining why the information was required. Eventually, the 
department agreed to the investigator’s request to remove the date of birth and make 
optional the requests for emergency contacts and home telephone numbers. 


The complainant reviewed the revised Traveller Profile form and was pleased with the 
deletion of the date of birth, and the now-optional requests for other details. He was 
also happy with the department's explanation of how the information is safeguarded 
and agreed that the case could be considered settled during the investigation. 
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Buying gallery ticket not an invitation to ongoing marketing 


An art lover who purchased a ticket to the National Gallery's Klimt exhibit was 
disconcerted when called on to support the Gallery’s ongoing programs. Shortly 
after buying the Klimt ticket, the complainant received a call from the National 
Gallery Foundation asking whether she had enjoyed the exhibit. She ended the 
call. 


Some time later, when a foundation volunteer called again to solicit her support, 
the woman asked how they knew about her visit and why she was on the call list. 
Since the volunteer did not know, she asked the gallery directly. They revealed 
that they routinely disclose ticket buyers’ information to the foundation for fund 
raising. 


The woman complained to the Privacy Commissioner that the disclosure was improper. 
The investigator confirmed that the gallery builds a database from ticket sales for 
membership drives and to promote upcoming exhibits. The gallery removed her 
name from the database and apologized for the calls. It will also seek express consent 
in future before adding ticket purchasers’ names to the foundation’s database. 


The woman was satisfied with the resolution of her complaint, which the Office 
considers settled in the course of investigation. 


E-mail system confounds sender, discloses safety worries 


A Statistics Canada employee complained that his supervisor's e-mail branding 
him violent and a threat to others’ safety was an improper use and disclosure 
of his personal information. The e-mails between the supervisor and a human 
resources officer were available to all staff on the agency's internal network for 
five weeks. 


The complainant had filed a harassment complaint against his supervisor. The e- 
mails discussed the supervisor’s concern that the employee could become violent if 


given copies of her and other employees’ witness statements about the harassment 
complaint. 


Statistics Canada investigated the complaint as a possible breach of both its internal 
security and privacy policies. The agency’s e-mail system allows users to designate 
their e-mails as normal, personal, private or confidential; however, the Document 


54 


CompPLaINts 


Management Centre (DMC), which administers and maintains the electronic 
communication systems, does not routinely capture the designation. 


The disputed e-mail was sent through the DMC using the Agency Messaging 
Options which offers a “Complete Send” or, if senders select the “Options” function, 
two other possibilities. Senders can select an “Accessibility Option” which allows 
them to determine the message’s level of security and distribution, or the “Access 
Restriction Option’ which allows a “read only access”. Senders can also tell the DMC 
what level of access they want. However, they will only be aware of these choices if 
they select the Options function at the outset. 


The supervisor had attempted to classify her message by flagging it “Private” or 
“Confidential” through Microsoft Outlook. She had not understood that she also 
needed to flag it as “Protected” for the DMC. The DMC procedures require its 
classifiers to check the header information, analyze the contents, check the security 
level and verify with the sender if the security is unclear. The message is then sent to 
appropriate recipients. 


Two factors contributed to the inappropriate disclosure; the supervisor’s 
misunderstanding of the system’s method of controlling access—disclosure was not 
intentional, and the DMC’s failure to properly classify the message before putting it 
on the system. 


Following the complaint investigation, Statistics Canada issued agency-wide 
instructions on assigning security levels to e-mails. The agency is also considering 
having DMC personnel staff review any Outlook e-mail that is flagged with security 
designations before putting them in the database. Longer term, StatsCan will review 
the DMC’s workings and protocols on personal information and report progress to 


the Office. 


The Office concluded that the complaint was well-founded but, given the work 
underway on the e-mail system, the Office need take no further action. 


Incidents under the PrivacyAct === 


Over and above individual complaints, incident investigations are conducted into 
matters of improper collection, use or disclosure of personal information that 
come to the attention of our Office from various sources including the media and 
directly from departments themselves. They often highlight a systemic issue, or an 
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unrecognized privacy breach that needs to be fixed as soon as possible. Last year, the 
Office completed 27 investigations into mismanagement of personal information. Of 
these, five incidents concerned individuals receiving someone else’s information. All 
were determined to be isolated incidents and prompted renewed vigilance among 
government employees. 


‘Two cases of interest are described below. 


Gardener Finds Income Tax Information 


Several incidents involved stolen information. For example, early in 2004 a 
Vancouver Parks Board gardener found a bag containing income tax information 
under the False Creek Bridge. The bag contained 12 bundles of taxation 
remittance slips from two financial institutions. The slips contained the name, 
address, payment amounts and account numbers of various individuals and 
businesses. Only two of the bundles had been opened but all the documents 
were wet and had been exposed to the elements for some time. This information 
had been processed directly by a private clearing house on contract to the two 
financial institutions. The bag is believed to have been stolen in transit from the 
financial institutions to the Canada Revenue Agency. 


At the time of the theft, the agency determined that the stolen bag contained 1,600 
remittance vouchers. While the majority of the vouchers concerned businesses, 390 
were from individuals. Since the clearing house did not plan to contact any of the 
affected individuals, the Agency on its own initiative notified the clients of the theft 
so that they could take steps against identity theft. Our Office confirmed that clients 
had indeed been notified at the time of the theft so that they could take appropriate 
steps against identity theft. All information was apparently recovered and no individual 
privacy complaints were received relating to this theft. The Privacy Commissioner 
commends the Agency for its initiative in protecting the privacy of its clients, even 
though it was not responsible for this particular privacy breach. 
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Photos of CSC Employees Appear in CBC Story 


A Correctional Officer of the Correctional Service Canada (CSC) reported that 
on November 16, 2004 he had seen a photograph of himself and some of his 
colleagues on a CBC Web site in a story entitled “Ombudsman Looking into Abuse 
at Prison Unit’. 


The CSC’s Web site has a “Photofile” containing various photographs of penitentiaries, 
CSC office buildings, and correctional officers at work. The photos are intended to 
provide the media with photographs to illustrate news articles. Also on the CSC site 
and therefore publicly available is a CSC employee publication entitled Lets Talk 
which often contains photographs of employees at work. 


In this case, the CBC was preparing a story on allegations that correctional officers 
were abusing inmates in the segregation unit at Kingston Penitentiary. The CBC 
obtained a group photograph of several correctional officers from the CSC site, 
which it used to illustrate its story about abuse in the segregation unit. Although the 
individuals had nothing to do with the unit, by using the photo in this context, the 
CBC left the impression that they did. 


The CSC contacted the CBC which removed the offending photographs from its site. 
The CSC also removed the disputed photos from its “Photofile”. It then examined 
each remaining photograph to ensure that the individuals signed proper waivers before 
it displayed the photos on the site. However, CSC recognized that the waivers would 
have to be updated to ensure that employees knew that once their photographs were 
on the Web site, they could be reproduced and used for purposes other than simple 
articles about CSC. The department conducted extensive internal discussions with 
management and legal services on employee consent. CSC also temporarily withdrew 
Let’s Talk from the site until all the issues were resolved. 


The “Photofile” is now on the CSC site but it no longer contains any photographs 
of individuals. Let’s Ta/k has also returned to the CSC site but the photographs only 


depict people who have signed express consent/waiver forms. 


Public Interest Disclosures under the Privacy Act 


Paragraph 8(2)(m) of the Privacy Act gives heads of government institutions the 
discretion to disclose personal information without the individual’s consent when 
the disclosure benefits the individual or when a compelling public interest outweighs 
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the invasion of the individual’s privacy. The head of the institution is required (under 
subsection 8(5)), to notify the Privacy Commissioner of such disclosures, preferably in 
advance (unless some urgency dictates otherwise). The Office reviews the disclosures 
and, if deemed necessary, the Privacy Commissioner notifies the individual to whom 
the information relates. During the review process, the Office also advises institutions 
when it believes more personal information than is necessary to address the public 
interest is proposed for release. In this way, we minimize the intrusion into the 


individual’s life. 


Last year we reviewed 76 such notices, a large number of them in two categories. The 
first concerns disclosing the circumstances of death to family members. We received 
24 notices of this type, the majority of which came from the CSC and National 


Defence. 


The second significant volume — 21 — came from the RCMP and the CSC concerning 
individuals who were either unlawfully at large or being released from custody at the 
end of their sentences. All are considered at high risk to re-offend and therefore a 
danger to the community. 


Another 11 notices dealt with disclosures to Parliamentary Committees, Boards of 
Inquiry or other public entities on matters such as the sponsorship program, possible 
misconduct by public servants, or the circumstances surrounding accidental deaths. 


Also of interest were four notices from Health Canada concerning health risks to the 
public from individuals with communicable diseases, two notices to the Children’s 
Aid Society concerning possible child abuse, and four notices of security threats. 


Inguiriese "eo ey ee ee ee 
The Inquiries Unit responds to requests for information from the public about 
the application of the Privacy Act as well as PIPEDA. In this reporting year the 
unit responded to almost 3,000 inquiries solely dealing with matters pertaining to the 
Privacy Act and responded to some 17,000 requests for information under PIPEDA. 
In the course of the year, staff shortages in the Inquiries Unit coupled with the 
ongoing heavy volume of work have presented challenges. Asa result it was necessary 
to reassess the way we respond to public inquiries. We no longer accept or respond to 
inquiries or complaints by e-mail. We introduced an automated telephone system to 
answer the public’s most frequently asked questions such as those about identity theft, 
telemarketing and, of course, the social insurance number. And we continue adding 
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information to our Web site to answer the most frequently asked questions. We 
also temporarily assigned some investigators to help the unit. Lastly, we now invite 
individuals to telephone during office hours since we can often determine a caller’s 
needs faster and better in person than in a series of e-mails and letters. 


INQUIRIES STATISTICS 


(April 1, 2004 to March 31, 2005) 


The following table represents the total number of Privacy Act inquiries responded by the Inquiries 
Unit. 


Telephone inquiries 2,391 
Written inquiries (letter, e-mail, fax) 585 
Total inquiries received 2,970 


Inquiries Response Times 


Eighty per cent of inquiries were received by telephone. The majority of these were 
responded to immediately; the remainder which may have required research were 
responded to within one to two weeks. 


Written inquiries accounted for 20 per cent of the workload and, on average, were 
responded to within three months. Providing written responses to inquiries may be 
time consuming and labour intensive. Over the year, the Inquiries Unit accrued a 
backlog of written inquiries which exacerbated the average monthly turn around 
times. In the next fiscal year, we plan to implement new measures and to obtain 
additional resources to respond more quickly to the public’s queries. 
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Audit and Review. 


Strengthening the Audit Function 


he Privacy Act empowers the Privacy Commissioner (in subsection 37[1]) to 
investigate some 150 government institutions’ compliance with sections 4 to 8 of 
the Act. These sections set out federal government obligations when collecting, 
retaining, disposing of, and protecting personal information. The Act also authorizes 
the Commissioner to audit certain databanks that are exempt from individual access. 


In March 2005 the Office re-named its compliance review branch Audit and Review. 
This signals an important change. The Office has not used its audit powers to their 
full potential in assessing the quality of privacy management, or addressing the risks 
inherent in current federal operations. In the past year we began rebuilding and re- 
enforcing the audit and review functions. We intend to make greater use of audits 
and they will become an important tool in carrying out our mandate pursuant to the 


Privacy Act and PIPEDA. 


Our Office’s goal is “to conduct independent and objective audit and review of 
personal information management systems for the purpose of promoting compliance 
with applicable legislation, policies and standards and improving privacy practices 
and accountability”. 


It will take time to build sufficient audit capacity, as well as meet departments’ demand 
for timely reviews of privacy impact assessments as Treasury Board policy requires. In 


preparation, we have taken the following steps: 


e Completed an external review of audit methods and practices; 
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e Seta branch goal and articulated team values; 

e Began developing a longer term audit strategy and plan in view of privacy 
risks and issues; 

e Built a business case to increase audit and review resources; 

e Raised awareness with Parliamentary Committees on the potential of privacy 
auditing; and 

e Improved audit practices as part of the audit of the CBSA (see below). 


Auditing Cross-Border Flow of Personal Information 


As mentioned earlier in this report, improving border security became a top priority 
for Canada and the United States following the events of September 11, 2001. A 
number of national security measures were instituted under the December 2001 
Manley/Ridge Smart Border Declaration and 30-Point Action Plan. 


Since then the government has allocated approximately $10B for national security 
programs and initiatives. Over $1.7B of that amount was given to the CBSA to 
implement measures aimed at strengthening land, marine, airport, and border 
crossing infrastructures; increasing the agency’s human resource base; and improving 
its detection tools. 


Canada and the U.S. also committed to enhancing border enforcement by exploring 
options for exchanging information and making better use of technology. The CBSA 
and the United States Department of Homeland Security (DHS) have worked on 
several initiatives that deploy technology and resources to better manage risk at the 
Canada-U.S. border. The initiatives include joint enforcement, joint-screening facilities, 
coordinated intelligence, and integrated databases to allow sharing of intelligence. 


However, the Canadian public is concerned about the flow of personal information 
to the U.S. Media reports have indicated that Canadians are not willing to trade 
their privacy for measures which do not clearly enhance their security. This has been 
supported by an EKOS Research Associated survey commissioned by our Office, 
which indicates that 75 per cent of Canadians surveyed believe Canadian government 
agencies transfer citizens’ personal information to foreign governments in order to 
protect national security, and with that 85 per cent of those surveyed reporting a 
moderate or high level of concern about such transfers. 


Privacy and human rights advocates and Canadian politicians have all raised concerns 
about the implications of transferring personal data across international borders. 
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Among the concerns are data mining, racial profiling, direct access to databases by 
American authorities, secondary uses of information, matching data with private 
sector information, and the potential of the USA PATRIOT Act overriding Canadians’ 
privacy rights. 


Given this context, in July 2004 our Office notified the President of the CBSA that 
it intended to audit the Agency’s management of the trans-border flows of personal 
information under its control. 


The objective of the audit is “to assess the extent to which the CBSA is adequately 
controlling and protecting the flow of Canadians’ personal information to foreign 
governments or institutions thereof”. The audit will focus on exchanges of information 
between Canada and the U.S. A key element will be to map (to the extent practicable) 
the information about Canadians that the CBSA transmits to the U.S. and for what 
purpose. 


We believe that national security objectives and sound personal information 
management practices are mutually dependent. Rigorous controls over the gathering 
and use of personal information will limit such privacy risks as improper uses or 
disclosures, and also support a robust national security objective. Relevant, timely 
and accurate information sharing is the life-blood of enforcement and intelligence 
operations. However, sharing must take place with the highest standards of privacy 
and security protection to prevent losing credibility with the public, Parliamentarians 
and foreign partners. 


The general criteria guiding the audit are that collection, use and disclosure of personal 
information must be limited to that which is necessary and permissible by law. They 
should also be circumscribed by multiple layers of privacy and security protections 
during the life-cycle of the information so as to prevent and mitigate risks to personal 
privacy and program objectives. 


The CBSA’s customs and immigration enforcement programs require it to collect, 
use and disclose considerable sensitive personal information. The information might 
include financial, family history, health, and travel information; personal identifiers 
such as the social insurance number, immigration and passport numbers; and 
biometrics digital photographs, fingerprints and iris scans. 


Due to the CBSA’s size and complexity, our Office has spent most of its limited audit 
resources on determining which of the agency’s many programs and information 
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management activities have the greatest impact on individuals’ privacy. The Office 
will focus its audit on these areas. 


To better understand the CBSA’s business, the audit team has reviewed open source 
information, descriptions of CBSA programs and activities, internal policies on 
managing personal information, applicable training materials, information flow- 
charts, information sharing agreements, privacy impact assessments and IT system 
descriptions. The team interviewed selected personnel at headquarters and several 
regional operational units. We observed customs officers at the primary inspection 
line and secondary examination areas. The team was also briefed on the electronic 
systems used at land borders and airport terminals to assess whether a traveller or 
passenger poses a risk. 


This phase of the audit was completed early in the 2005 fiscal year. Examination is 
began in May 2005 and an audit report completed by January 2006. 


Other Audit and Review Activity 


HRSDC databank reviews 

Since 2001, our Office has reviewed about 60 data linkage proposals by Human 
Resources Development Canada (now Human Resources and Skills Development 
Canada-HRSDC and Social Development Canada-SDC). These reviews are 
mandatory under a Governance Protocol that came into force in 2000 following 
significant concerns about HRDC’s Longitudinal Labour Force File (since 
dismantled). The protocol governs all future research involving data linkage. 


The quality of data linking proposals submitted to our Office has increased significantly— 
to the point that we rarely find it necessary to give advice to HRSDC. The department 
has developed the internal capacity to identify and respond to privacy risks associated 
with data linkages for research and program evaluation. The Governance Protocol is a 
model we encourage other departments and agencies to adopt. 


Accordingly, in March 2005 our Office wrote to both departments recommending 
that their review of data linkage proposals be made optional and at the departments’ 
discretion. The departments adopted the recommendation and will make the 
necessary amendment to the Governance Protocol. We proposed the change on the 
understanding that the departments would maintain the integrity of structures and 
procedures. We also expect SDC and HRSDC to minimize any potential disruption 


on the internal review caused by the separation of their responsibilities. Finally, we 
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encourage personnel from both departments to share their knowledge and experience 
with colleagues from other departments and agencies. This should reinforce their 
capacity to assess the privacy impact of any form of data matching or linkage. 


Given HRSDC and SDC’s large and complex systems which contain extensive 
personal information, we expect to conduct a future audit to determine whether their 
privacy management frameworks are sustained and continue working effectively. 


Data Matching 

Under the Treasury Board Secretariat (TBS) of Canada’s Policy on Data Matching, 
federal departments and agencies are required to notify the Office of any data 
matching proposal. The purpose is to afford the Office an opportunity to review and 
comment on such proposals. 


Given the small number reported to us, our concern is not so much the data matching 
proposals that take place, but the risk of data matching that is unreported and/or not 
subject to assessment. Information obtained from TBS indicates that there is confusion 
among departments as to the meaning of data matching that may contribute to under 
reporting of such activity. TBS is now addressing the confusion. We share the concern 
and favour a clear and comprehensive definition that would capture the activity in 
various forms whether called data matching, linking or mining. 


At the moment, it is not clear if the federal government has a handle on the extent 
of actual “data matching” of personal information, including activity carried out by 
third parties engaged under contract with the federal government, and whether they 
are in keeping with legislation, policy and good personal information management 
practices. We will continuing monitoring developments and consider the possibility 
of carrying out a future audit in this subject matter area. 


Follow-up review of the Canadian Firearms Program 

The Office first reviewed the Canadian Firearms Program in 2001. Since then, we 
have monitored developments (see pp. 49-50 of Annual Report 2003-04). As the 
result of ongoing negotiations to improve practices, last year we received a positive 
response from the-now Department of Public Safety and Emergency Preparedness 
Canada indicating that they had taken steps to address our concerns. These include 
better written agreements with contractors to protect personal information, limiting 
access to municipal and provincial police information retrieval systems to a need to 
know basis, reiterating that it will not disclose personal information to employers, and 


improving consent forms. 
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However, given the passage of four years, the controversy surrounding the program, 
and the many ensuing changes, including recent amendments to the Firearms Act, it 
is time to refresh our knowledge of the program in order to plan a new audit. 


Privacy Impact Assessments 

The Treasury Board of Canada requires federal departments and agencies to conduct 
Privacy Impact Assessments (PIAs) on all new government programs or services that 
raise privacy issues. Assessments are also required when departments substantially 
change existing programs and services so as to require new or increased collection, 
use or disclosure of personal information. Departments must also assess new data 
matching, contracting-out or other changes that may have privacy implications. 


The Treasury Board PIA policy is critical to protecting privacy. And, despite their 
inconsistent quality and thoroughness, PIAs have improved considerably. The 
improvement trend continued last year. We are particularly pleased that departments 
are increasingly including action plans in their PIA submissions. This is an encouraging 
sign that the PIA policy is having its intended impact; ensuring that government 
adopts privacy as a core consideration in planning, designing, and implementing 
programs and services. 


Implementing a strategy to meet the PIA policy’s requirements is a key component 
of any departmental privacy management framework. The policy itself promotes 
adopting a privacy governance structure. For example, the policy guidelines establish 
the accountabilities that form the core of a privacy management framework. The 
guidelines expect departmental heads to define the roles of personnel on adhering to 
the policy’s requirements. The departmental heads must also assume responsibility for 
overseeing implementing the requirements. 


We continue encouraging departments to establish a formal administrative structure 
that will review departmental initiatives to determine whether they require a PIA. The 
structure or bodies should define responsibility for issuing departmental directives 
and guidelines on compliance with the policy’s objectives, and establishing bodies to 
manage PIAs. The bodies would review proposals to determine whether assessments 
are required; oversee and coordinate their conduct, consult with relevant stakeholders, 
approve recommendations, and monitor implementation of the recommendations. 


Departments should also consult Treasury Board Audit Guides, particularly the 


section in the PIA Audit Guide entitled “Management Control Framework”, which 
outlines appropriate administrative structures to support the policy. 
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As part of our review of PIAs (as required by Treasury Board Policy) we routinely ask 
departments to report the actions they will take in response to our recommendations 
and we will assess compliance with the policy’s requirements and objectives in any 
future audit. 


‘Treasury Board scheduled a comprehensive review of the PIA policy in May 2007, five 
years after its official launch. However, the Board seized the initiative — conducting 
an interim review of a small sample of federal departments and programs in June 
2004. This early start allows the Board to assess the impact on privacy compliance, 
and identify any potential improvements. The Board consulted relevant stakeholders 
(including our Office) during the review. We concur with most of the study’s findings 
and recommendations. 


The study concluded that the policy had indeed enhanced privacy compliance 
significantly in the selected departments. There are, understandably, several areas 
requiring attention. These include, for example: 


e acquiring the expertise needed to conduct PIAs; 

e coordinating and integrating the contributions of stakeholders; 

e documenting observations with the necessary evidence; 

e harmonizing PIAs with other government policies, such as the government’s 
security, data matching, and social insurance number policies; and 


e making PIA summaries publicly available. 


The study also concluded that our Office’s oversight and advisory role is critical to 
ensuring both the integrity of the assessment process and public confidence in the 
policy. However, our ability is compromised by a lack of resources. We welcome the 
study’s acknowledgment of the need to provide adequate funding. The matter will 
form part of an overall business case for permanently funding our Office planned for 
submission to the Treasury Board later in 2005. 


Treasury Board’s study also found no single reliable source of information on how many 
assessments have been conducted. Nor is there a sufficiently complete mechanism in 
place for ensuring assessments is always conducted on initiatives that would warrant 
such analysis. Departments need to improve their monitoring and reporting, and their 
annual reports appear to be the appropriate method. 


67 


Annuat Report To PartiAMENT 2004-2005 - Report On THE Privacy Act 


In April 2005 Treasury Board issued revised reporting guidelines for fiscal year 2004- 
2005 regarding annual reports on the Access to Information Act and the Privacy Act. We 
are pleased to see the guidelines now require departments to report on the number of 
PIAs and preliminary assessments conducted during a fiscal year. 


Given indicated shortcomings, we are considering auditing the functioning of the 
whole PIA system. We are concerned that assessments are not being done when they 
should. And we need to determine whether systems and procedures are working to 
ensure departments follow through on the assessment findings as part of their privacy 
management program or framework. 
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Privacy Act Applications 


nce the Privacy Commissioner has investigated a complaint, Section 41 of the 
Privacy Act allows the individual to apply to the Federal Court for review of the 


government’s refusal to provide access to personal information. The following 
applications were filed in the past fiscal year: 


al Keak Maydak v. Solicitor General of Canada (Federal Court file No. T-972- 
04) 

2. James R. Gairdner v. Jennifer Stoddart et al (Federal Court file No. T-2005- 
04) Discontinued February 2005 


Section 42 of the Privacy Act also allows the Commissioner to appear in Federal 
Court. The Commissioner may ask the Court to review an institution’s refusal of 
access to personal information (with the complainant’s consent). She may act on 
behalf of individuals who have applied for review themselves, or with the leave of the 
Court, be a party to any review sought under section 41. The Privacy Commissioner 
did not appear in court in any of these capacities in the past fiscal year. 


The Privacy Commissioner can also become involved in applications where the 
complainant improperly names the Commissioner as a respondent and tries to seek 
relief against her that is not available. The following two such cases were decided in 
the fiscal year: 
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Gauthier v. Canada (Department of Justice) and Privacy Commissioner of Canada 
Federal Court File No. T-653-02 


Mr. Gauthier requested that the Department of Justice provide him with access to 
all personal information about himself. After consultations with a variety of other 
institutions, the Department provided him with a total of 685 pages of information 
and advised that some information had been withheld under sections 26 and 27 of 
the Privacy Act. Mr. Gauthier complained to the Privacy Commissioner that the 
Department was improperly withholding his personal information. 


The former Privacy Commissioner reviewed the information which had been withheld 
and agreed that the section 26 and 27 exceptions had been properly applied and thus 
that the complaint was not well-founded. Nevertheless, the Commissioner asked 
Department of Justice to reconsider its exercise of discretion with respect to some of 
the information, upon which information was released to Mr. Gauthier. 


Mr. Gauthier filed an application under s. 41 of the Privacy Act in which he asked 
improperly for, among other things, review of the findings of the Privacy Commissioner 
with regard to his complaint. 


In October 2003, the Interim Privacy Commissioner filed representations regarding 
the lack of Court jurisdiction to review the findings of the Privacy Commissioner. 


A hearing was held on March 31, 2004, at which time Mr. Gauthier conceded that he 
was not in fact seeking a review of the Privacy Commissioner’s findings but only of the 
decision of the government institution to refuse to provide him with access to all his 
personal information. In a decision which reviewed the principles of solicitor-client 
privilege and determined that some of the information should have been released, the 
Application against the government was allowed in part on May 4, 2004. 


Mamidie Keita and Bernard Michaud v. The Minister of Citizenship and Immigration Canada and 
the Privacy Commissioner of Canada 
Federal Court File No. T-676-03 


The complainants had sought personal information in all Citizenship and Immigration 
Canada offices, especially embassies in Guinea, the Ivory Coast, Ghana and Senegal. 
Dissatisfied with the response from CIC, they lodged a complaint with the Privacy 
Commissioner, who investigated and concluded that the complaint was well-founded 
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at the time it was lodged. However, since CIC provided the complainants with the 
additional information to which they were entitled in the course of the investigation, 
the Privacy Commissioner considered the complaint resolved. The Commissioner 
agreed with CIC that the remaining information withheld from the complainants 
was third party information which was exempt under section 26 of the Privacy Act. 


The complainants then filed for a Court review under section 41 of the Privacy Act. 
Since the application improperly named the Privacy Commissioner of Canada as a 
respondent, the Interim Privacy Commissioner filed a motion in July 2003 requesting 
that he be struck from the application. The Court dismissed the motion suggesting 
that the issue was overly complex in this case and best dealt with at trial. 


The Application was dismissed on April 28, 2004, with the Court reiterating that 
the Applicants cannot, by means of a review application against the government 
institution, also obtain judicial review of the Commissioner’s recommendations. 
The Court also confirmed that the section 26 exemptions were proper and that the 
Applicants had received all the personal information to which they were entitled. 


Judicial Review 


Complainants will sometimes seek judicial review under section 18.1 of the Federal 
Courts Act against the Privacy Commissioner. This occurred in the case described 
below, where the Commissioner was required to explain her jurisdiction to the Court 
when the complainant sought remedies that the Commissioner had no authority to 
grant. This case illustrates the seriously limited remedies available under the Privacy 
Act for any breaches other than improper denials of access. The Commissioner finds 
herself in the unenviable position of having to demonstrate to the court how she is 
unable to help the complainant. Clearly, this is an important issue for Privacy Act 
Reform. 


Brian Murdoch v. Royal Canadian Mounted Police and Privacy Commissioner of Canada 
Federal Court File No. T-1180-04 and Federal Court of Appeal File No. A-183-05 


Mr. Murdoch complained to the Privacy Commissioner, that among other wrongful 
conduct, the RCMP had breached the Privacy Act by disclosing his personal information 
to his employer without his consent. The Assistant Commissioner responsible for the 
Privacy Act agreed that his disclosure complaint was well-founded. 
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On June 18, 2004, Mr. Murdoch sought a judicial review of the Assistant 
Commissioner’s report on his disclosure complaint. Although the Privacy Act restricts 
remedies to questions of access, he argued that the Privacy Commissioner must 
necessarily have the authority to fashion remedial orders and relief in cases (like his) 
where the Act has been contravened. 


On June 29, 2004, the Privacy Commissioner filed an objection to Mr. Murdoch’s 
request that she provide him a certified copy of all material and relevant documents 
in her possession. In August 2004 she moved to strike the application. However, the 
Court denied the motion in September 2004 noting that the merits of the Privacy 
Commissioner’s argument (that she has no authority or jurisdiction to grant the 
remedies sought) could easily be determined when the Court heard the application. 


Ata hearing in March 2005 the Court determined that the Privacy Commissioner had 
fulfilled her obligations under the Privacy Act and had correctly advised the applicant 
that the Act provides no penalty to address the respondent’s breach of his privacy. The 
applicant can obtain no further award in the Court for the improper disclosure. 


Mr. Murdoch appealed the Federal Court decision in April 2005. 
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he Office of the Privacy Commissioner of Canada is mandated specifically 
Tome PIPEDA to develop and conduct information programs to foster public 

and organizational understanding and recognition of the rules that govern 
the collection, use and disclosure of personal information. And although there is 
no legislative mandate for public education specified under the Privacy Act, there 
is certainly a mandate to ensure departments and agencies are held accountable for 
their personal information handling practices. There is often a necessity to inform 
the public, as well as departments and agencies, about the requirements of the Act 
and related policies, and the impact on the privacy rights of Canadians of current and 


proposed government activities. 


In 2004-2005, the Office undertook a strategic communications planning 
effort with the expertise of external consultants, and the result was a comprehensive 
communications and outreach strategy for the coming fiscal years. This strategy 
will enable the Office to have a more comprehensive, proactive approach to 
communications planning and delivery; a more truly public education-focused 
approach to communications surrounding PIPEDA; and build a greater level of 
awareness of the Office and of key privacy issues under both laws. 


In addition to developing this strategy the Office undertook the following 
communications activities in 2004-2005: 


Speeches and Special Events 

Speaking engagement opportunities have helped our Office raise awareness of 
privacy issues among diverse audiences and settings, including professional and 
industry associations, non-profit and advocacy groups and universities. In 2004-2005, 
the Commissioner, Assistant Commissioners and other senior officials delivered 
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21 speeches, speaking out about issues with privacy implications, such as security 
initiatives and health care delivery. 


In March 2004, the Office began hosting an in-house Lecture Series (approximately 
one per month). These information sessions featured experts on a variety of privacy 
issues and brought together members of the privacy community and staff. In 2004- 
2005, the Office hosted nine of these information sessions. 


Media Relations 

Privacy issues continued to be of interest to the media in 2004-2005, with significant 
coverage in Canada on issues such as privacy and security, about which the Office 
received media calls and participated in interviews. In addition, through other proactive 
media relations efforts, such as the dissemination of news releases, the Office had 
the opportunity to raise awareness of, for example, the launch of its Contributions 
Program; the Commissioner’s views on important legislation, such as the do-not- 
call list legislation; and the Office’s views regarding transborder flows of personal 
information. 


Web Site 

We post new and useful information on our Web site on an ongoing basis. Fact sheets, 
news releases, speeches, case summaries of findings under PIPEDA, are posted to 
keep the site interesting to individuals and institutions. In 2004-2005, the Office 
redesigned its Web site in order to make it compliant with the Common Look and 
Feel standards established by Treasury Board. This resulted in an enhancement to 
the design as well as to the navigation tools on the site, in order to help visitors make 
better use of the site. The Office also made the site more dynamic with the posting of 
a downloadable Web-video for businesses on complying with PIPEDA. Since 2001- 
2002, we are pleased to report that visits to the site have more than quadrupled, 
reaching 904,886 in 2004-2005. 


Publications 

The Office has produced information materials, including guides for individuals and 
institutions on PIPEDA, as well as a variety of new fact sheets on issues including 
consent, use of the social insurance number in the private sector, transborder flow 
of personal information, and how our Office conducts investigations into potential 
privacy breaches. 


In 2004-2005, in addition to preparing new fact sheets, we developed an e-kit 
for businesses to help them comply with the new law. We also revised the content of 
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our guides, to ensure they were up-to-date given the final stage of implementation 
of PIPEDA on January 1, 2004. We received requests for these materials on a daily 
basis. Not only were these materials sent to individuals upon request, they were also 
distributed at conferences and special events, and accessed in electronic format by 
visitors to our Web site. In 2004-2005, close to 22,000 of our publications (guides, fact 
sheets, annual reports, copies of both federal privacy laws) were sent out, in addition 
to the more than 635,000 publications which were downloaded from our Web site. 


Internal Communications 

Internal communications activities were also a focus of the Office and played a key 
role in 2004-2005, increasing transparency between management and staff, especially 
during its ongoing institutional renewal, but also through day-to-day activities. Internal 
communications activities in 2004-2005 involved providing staff with information on, 
for example, human resources issues, upcoming speaking engagements, Parliamentary 
appearances, senior management and labour management committee meetings, and 
special events such as all-staff meetings and information sessions. The Office has 
been developing an Intranet, an internal communications portal to host all internal 
communications and maximize staff access to information, which will be launched 


in 2005-2006. 
In the upcoming year, the Office will continue to undertake the activities outlined 


above. We also hope to be in a position to initiate many of the more proactive public 
education activities outlined in the communications and outreach strategy. 
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Corporate Services 


On the Path to Institutional Renewal 


he Commissioner’s most immediate priority has been to lead the Office’s 

institutional renewal by strengthening OPC management processes, particularly 

human resources and financial management — planning, budgeting, reporting and 
control mechanisms. 


Planning and Reporting 

A foundation component of the Office’s institutional renewal is a strategic planning, 
reporting and control process. During 2004-05 we completed our first year under this 
revised process. The strategic plan established at the beginning of the year was our road 
map for the year. As part of the new process were reporting and review opportunities. 
We made adjustments to plans and budgets throughout the year. To assist in our 
reporting and reviews we developed a Performance Measurement Framework and 
a monthly performance report. We also launched a Business Process Review of the 
entire institution which will enable the Office to better estimate resource requirements 
and to draft a business case for permanent funding. 


Human Resources 

We continue to work toward the development and implementation of changes to 
improve how the office is run and the quality of the workplace. Significant changes 
and improvements have been made to the Human Resource management policies 


and practices. 


We developed a number of Human Resource policies in consultation with central 
agencies and unions. These policies will guide us as we build on the successes of 
the past year and we continue on our path of institutional renewal. An Instrument 
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of Delegation of Human Resource Management was developed and will serve as 
a tool to inform and guide managers, and enable them to manage their human 
resources. A new Strategic Human Resource Plan and Staffing Strategy, as well as an 
Employment Equity Action Plan, will help the OPC achieve its mandate and ensure 
the recruitment of a highly qualified workforce that is diversified and representative 
of Canadian society. As part of OPC’s commitment to increase transparency in the 
staffing processes, a staff newsletter was developed; it is distributed on a monthly basis 
to all staff. 


Over the course of the past fiscal year we made significant strides in the area of 
organizational learning, including the development of a learning strategy with the 
Canada School of Public Service (CSPS), training and information sessions in values 
based staffing, language training sessions, performance management and employee 
appraisals and harassment in the workplace. The development and implementation 
of a Learning Strategy and Curriculum with the CSPS will enable staff to continue 
to develop the expertise and competencies required to fulfil their functions, as well as 
to position staff to take on new responsibilities and accountabilities. 


We continued to work collaboratively with Central Agencies such as the Public 
Service Commission and the Public Service Human Resources Management Agency 
of Canada on follow-up measures to the recommendations of the Public Service 
Commission and the 2003 report of the Auditor General of Canada. This included 
measures that will allow OPC the opportunity to regain its full staffing delegation 
authority. 


Finance and Administration 

The OPC received a clean opinion on Audited 2003-2004 Financial Statements by 
the Office of the Auditor General of Canada. This is a significant milestone and 
a very positive indicator that the institution has indeed advanced on the path of 
institutional renewal. The institution has built on that success by establishing planning 
and review cycles, by streamlining and improving the financial management policies 
and practices. 


Information Management / Information Technology 

Signification advancements have also been made in how we manage our information 
assets. We completed an audit of our information management systems and we 
completed a vulnerability assessment of our information technology. We also completed 
an information technology strategy. This will help us to not only meet our obligations 
with respect to the management of government information and security policies, but 
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more importantly it will guide us as we move forward in improving on the management 
of our information assets. During the year we completed a significant upgrade to 
our case tracking and reporting system, Integrated Investigations Application (IIA). 
Finally we also established the framework for an internal Intranet site. This site will 
allow for effective communicating and sharing on information for employees. 


Down the road 

Strategic planning is an important annual exercise for the OPC. Our last session in 
January 2005 provided managers and employees an opportunity to re-examine the 
OPC’s priorities for 2005-2006, and the actions they would take to achieve these 


priorities. 
Corporate Services priorities for 2005-2006 are to: 


e Develop and implement a Management Accountability Framework (MAF); 

e Implement and maintain a human resource strategy that enables the 
Office to recruit, retain and develop staff and foster a continuous learning 
environment; 

e Satisfy central agencies’ requirements to regain delegated authorities, and 
enable the Office to take on new delegation to implement the Public Service 
Modernization Act; 

e Develop and implement integrated information management, 

e Complete Business Case for Resources for the OPC; 

e Review Corporate Services Branch and Human Resources Branch policies 
and procedures; and 

e Continue providing effective integrated financial services to the OPC. 


Our Resource Needs 

At the beginning of fiscal year 2004-2005, the Office’s budget was $11.2 million, 
the sare as the previous year. Included was $6.7 million for the Office’s PIPEDA 
activities. Ongoing funding of OPC activities continues to be extremely important. 


With privacy rights continually under threat, the Office’s operations need to be funded 
adequately so that it is prepared to address the multitude of emerging privacy issues in 
the public and private sector. 


The Office does not have adequate resources to fully exercise its powers and 
responsibilities under both Acts. Without adequate permanent funding, the Office 
cannot: 
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e Reinforce our audit and review functions to effectively address compliance 
under both privacy laws or strengthen our capacity to monitor, research and 
respond to emerging issues of technology and privacy; 

e Conduct outreach and public education to influence change so policies and 
programs are viewed through a privacy lens; 

e Continue investigating in a timely manner and resolving the growing number 
of complaints under both Acts; and 

e Continue providing specialized legal and strategic advice and litigation 
support under both federal privacy laws, as well as strengthening established 
approaches and procedures to deal with cross-jurisdictional complaints. 


To this end, the Office’s priority beginning in the last quarter of fiscal year 2004- 
05 was to completely review all business processes. The review included establishing 
workload indicators and reviewing the legislative requirements, as well as external and 
internal factors that have an impact on our operations. This will enable the Office 
to develop a Business Case and make a formal submission to the Treasury Board 
Secretariat and to Parliament later in 2005 to stabilize our resource base and seek 


permanent funding for the Office. 


We hope that with adequate permanent funding, the Office can further assure 
Parliament that it is effectively ensuring respect for Canadians’ privacy rights in the 
public and private sectors. 
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Financial Information 


April 1, 2004 to March 31, 2005 


Expenditure Totals % of Totals 


($) 
Privacy Act 3,745,058 32 
PIPEDA 6,849,650 58.5 
Corporate Services 1,107,296 9.5 
Total 11,702,004 100 


Note: Although OPC salary budget allows for approximately 100 FTEs (full-time equivalents), there 
were only 86 FTEs staffed at the Office at the end of March 2005. 


Detailed Expenditures” Privacy Act PIPEDA Corporate Total 
Services 

Salaries 3,330,147 3,039,732 419,120 6,788,999 
Employee Benefits Program 190,327 844,575 154,640 1,189,542 
Transportation & Communication 41,238 266,129 81,282 388,649 
Information 1,907 147,911 5,239 155,057 
Professional Services 171,783 1,397,579 210,403 1,779,765 
Rentals 2,730 107,874 23,759 134,363 
Repairs & Maintenance 4698 155,805 85,353 245,856 
Materials & Supplies 9,304 50,764 21,633 81,701 
Acquisition of Machinery & 384 451,788 98,026 550,198 
Equipment 

Other Subsidies & Payments -7,460 20,084 7,841 20,465 
Transfer Payments 0 367,409 0 367,409 
Total 3,745,058 6,849,650 1,107,296 11,702,004 


" Total expenditure figures are consistent with the Public Accounts of Canada. 


Financial Statements 

The Management Responsibility letter and the audited financial statements as at 
March 31, 2005 will be available on our Web site at www.privcom.ge.ca in October 
2005. 
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Dear Mr. Speaker: 


I have the honour to submit to Parliament the Annual Report of the Office of 
the Privacy Commissioner of Canada on the Privacy Act for the period from April 1, 
2005 to March 31, 2006. 


Yours sincerely, 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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FOREWORD 


ext year will be the 25" anniversary of the 
( | \ | Privacy Act, Canada’s first comprehensive privacy 

legislation. Revised from the 1977 part IV of the 
Human Rights Act, which recognized the basic principles and 
established a Privacy Commissioner who was a member of 
the Human Rights Commission, the Privacy Act was framed 
in the kind of thinking we had about government in the 
1960s and 1970s. We worried about big central databases, run on huge mainframe 
computers. We talked about files, and we thought of records systems as paper files in 
filing cabinets. All that was before the personal computer, the Internet and powerful 


search engines like Google. Public servants did their work on paper, armed with 
typewriters filled out forms in triplicate. 


Why am I wandering down memory lane? Because the world has changed in ways 
that are profound, and deeply troubling from the perspective of individual privacy 
and human rights. When we imagined powerful central computers which could 
impact privacy, armed with the new social insurance number to secure reliable 
matches, we lived in a world that was strictly bounded by capacity... the limited 
capacity to store data, the limited capacity to match data, the limited capacity to 
move data around and expose people to risk of privacy breaches. The Office of the 
Privacy Commissioner was designed as a small agency, with very limited powers, 
and Treasury Board Secretariat and the Department of Justice were tasked with 
implementing the new legislation and helping public servants to interpret it. 


Now we live in a world that is strictly bounded by our capacity to understand it, 
by our ability to keep up with the pace of technological change, and to manage the 
_ new risks and security challenges that come with limitless storage capacity, limitless 
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transmission capacity, limitless data mining capacity. We are bounded by our own 
limited capacity to understand, to imagine the implications of data flow and data 
aggregation, and our ability to teach. The challenge of protecting data is increasingly 
globalized, because actions in one distant part of the world now may directly impact 
the privacy of Canadians. A spammer sending unwanted e-mail with spyware from 
somewhere in Eastern Europe can cause havoc in a Canadian internet service provider, 
wiretaps to detect anything from terrorism to money laundering are global in scope 
and application, and Canadian travellers need identity documents and financial 
instruments that will help them establish credentials as they do business around the 
world. Life is complicated, and so is privacy in today’s world. 


We need to understand the implications of countless new information systems, new 
laws and regulations, new systems of surveillance which are being constructed in the 
name of public safety. We need to audit more of these applications, to bring earlier 
insight and assistance to government departments who have a myriad of complex 
decisions to make and may not be as well versed in privacy matters as we are. We are 
determined to move forward with new resources and further enhance our ability to 
provide advice and assistance to Canadians, to Parliament and to the many public 
servants who are working to improve life for Canadians. 


But at the risk of sounding like Oliver Twist, I want to say “Please sir, can I have 
some more?” It is my sincere hope that we can celebrate the federal public sector 
privacy law’s anniversary with the knowledge that Parliament will give us a new 
Privacy Act. We need one that can respond to the age of information, to the 
challenges of ambient computing, to the reality of huge government systems that are 
capable of a surveillance we could not have dreamed of in 1982. Poll results suggest 
that more than 70% of Canadians have a high sense of erosion of their privacy and 
the protection of their personal information, and predict that it is one of the most 
important issues facing the country. 


Canadians deserve real redress when things go wrong, not a Privacy Commissioner 
who has no power to even take a wrongful collection or a shameless disclosure of 
personal information to the Federal Court for a judgment and damages. We had 
started down a path of providing rights for Canadians in 1982, and we went a 

step further with the coming into force of the Personal Information Protection and 
Electronic Documents Act for the private sector in 2001, but we must now go further 
and ask our government to meet the standards that the power the information age 
demands. It is not acceptable that the standards for privacy protection are higher for 
the private sector than they are for the public sector. 


FOREWORD 


We are proud to be hosting the International Conference of Data Protection and 
Privacy Commissioners in the fall of 2007 in Montreal. More and more, other 
countries, many of which will be attending this important event, are looking to 
Canada as a model for data protection. As an illustration of the interest other 
countries have in our data protection regime, we have had professional development 
activities with the authorities in Mexico, France and the U.K. Canada must keep its 
place as a leader in this area, and in my view this requires an update of the public 
sector law. It is simply not acceptable that we have higher standards for privacy 
protection in the private sector. 


Real privacy demands a real balance of power between the citizen and the state, 
with real oversight and real power to intervene. We can do it, and we are anxious 
to get on with the real work it entails. As we committed, we have recently tabled 
with the Standing Committee on Access to Information, Privacy and Ethics our 
recommendations for amendments to the Privacy Act shortly, and we look forward 
to a fruitful dialogue. 


Since my appointment as Privacy Commissioner in December of 2003, and certainly 
in the past fiscal year, my focus and that of my team has continued to be the 
institutional renewal of this Office. Rebuilding the Office had to take precedence. 
We also devoted our energies last year to a Business Case for long-term, stable 
funding, which involved an independent review of our activities and a presentation 
to a special Parliamentary Panel for their recommendation. I am pleased to report 
that the Office has now turned the page. We are moving forward with renewed 
vigour. We will continue our collaborative efforts with our provincial and territorial 
counterparts, as well as with our international colleagues, so that we can truly take 
on the significant privacy challenges ahead. 
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Our STRENGTHENED MANDATE 


Act and the Personal Information Protection and Electronic Documents 

Act (PIPEDA). Although they are two separate laws, we manage the 
resources as a single pool. To date, our Office has not received permanent funding 
to carry out its duties under PIPEDA and the funding level for the Privacy Act has 
remained unchanged for many years. Funding for PIPEDA was granted for three 
years only. PIPEDA came into force in stages, beginning in 2001 and reaching full 
implementation in 2004, and we thought it important to let the dust settle before we 
attempted to identify long-term financial needs. PIPEDA has now been in full force 
for two years, and the demands made of us under both laws are increasing. 


(): Office is responsible for overseeing compliance with both the Privacy 


Funding levels for the administration of both Acts left us unable to carry out our 
multi-faceted mandate. We now have a significant backlog of complaints particularly 
under the Privacy Act, and complainants are, quite understandably, becoming 
impatient. The small size of our team of auditors makes it impossible to conduct 
effective audits to ensure compliance. Even though we have adopted a risk-based 
approach, we need to intensify our audit activities. Funding limits also mean that 
our communications strategy has been primarily reactive, when proactive public 
education about privacy rights and obligations is required instead. Similarly, our 
Policy and Research Branch and our Legal Services Branch have been confined 
to putting out existing privacy fires, rather than anticipating and therefore more 
effectively addressing emerging privacy issues. 


In the past few years, the Office went through an extremely challenging period. 
However, every cloud has a silver lining. In this case, the silver lining was an 
opportunity to review the functioning of the Office, in detail, from top to bottom. 
The result is an Office of the Privacy Commissioner of Canada that is pointed in the 
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right direction. It is now time to put forward the Office’s new vision and we need the 
full set of tools to implement it. 


We are attracting new and highly specialized talent to our team. We have pursued an 
ambitious agenda to correct deficiencies in management of the organization. Audits 
and evaluations of our Office — by the Auditor General of Canada, the Public Service 
Commission and the Canadian Human Rights Commission — have so far been 
positive. And we have implemented a thoughtful, systematic process to determine 
our organizational needs. This Office is a stable institution worthy of the trust of 
Parliament and the Canadians it serves. 


The Vision of the Office of the Privacy Commissioner of Canada 


The Office has prepared two analyses of significance — a Vision and Institutional 
Service Plan, and a Business Case for Permanent Funding. Together, these describe 
who we need to be, for Canadians and on behalf of Parliamentarians, and what it 
takes to get us there. 


If funded appropriately, the Office can accomplish the following in relation to the 

activities regulated under the Privacy Act and PIPEDA: 

* undertake a meaningful number of audits and reviews to encourage greater 
compliance, and assist in developing a robust privacy management regime; 

* work with government institutions, and conduct legal and policy analyses of 
bills and legislation to assist Parliament; 

* make more proactive, extensive and effective use of the enforcement tools 
entrusted to us by Parliament, including Commissioner-initiated complaints, 
court actions and public interest disclosures; 

* carry out research into emerging privacy issues and trends to help citizens and 
policy makers understand current and future privacy challenges; 

* engage in public education to better inform individuals of their rights, and 
organizations of their obligations; 

¢ through a streamlined investigation process, tackle the growing backlog of 
privacy complaints; and, finally, 

* sustain institutional renewal efforts. 


Business Case: Resources 


This past year, our Office was pleased to take part in an innovative and entirely new 
process for seeking funding approval for the operations of Officers of Parliament. We 
embraced the opportunity to engage Parliament in a constructive dialogue about our 


Our STRENGTHENED MANDATE 


funding needs. But before doing so, we certainly did our homework. Our Vision and 
Institutional Service Plan and our Business Case for Permanent Funding provided 

a comprehensive framework for protecting the privacy rights of Canadians and 
residents, and for serving Parliament in meeting its needs for privacy expertise as it 
considers legislation. The Service Plan and Business Case are the Office’s blueprint 
for a stronger and more effective institutional role. 


Parliamentarians agreed with this vision. The new House of Commons Advisory 
Panel on the funding of Officers of Parliament was supportive of our request for 
funding. The Office will now be in a better position to serve Canadians with close to 
a 50% increase in human and financial resources. At the end of 2005-2006, on which 
we are reporting, we planning for that increase within the next two years. 


PoLicy PERSPECTIVE 


The Year in Parliament 


005-06 has been a busy year in Parliament for the Office. A key component 
of the work we do involves appearing before Committees of the Senate and 
House of Commons to provide our expert advice on the privacy implications 


of bills and other policy matters under consideration by Parliament. 


The Office was called on to appear before Parliamentary Committees a total of 
eleven times in fiscal year 2005-06 (sixteen times in calendar year 2005). For a small 
organization such as our own, this represents a considerable amount of work, but 
because the Privacy Commissioner is an Officer of Parliament it is central to our 
mandate. Ten of these eleven appearances were on bills and policy issues that fall 
under the purview of the Privacy Act, although some appearances, such as those on 
funding, also pertain to the Personal Information Protection and Electronic Documents 
Act. 


Bill S-18, An Act to Amend the Statistics Act. (Before the House of Commons 
Standing Committee on Industry, Natural Resources, Science and Technology.) 


* This enactment removes a legal ambiguity in relation to access to census records 
made between 1910 and 2005. It allows unrestricted access to those records, 
beginning 92 years after the census was taken. Starting in 2006, the consent of 
Canadians is required in order for their census information to be released 92 
years after the census is taken. The OPC did not oppose the release of census 
records after 92 years and would be pleased to see consent provisions included 
in the Act, noting that Canadians should have the right to decide for themselves 
if they want their personal census records to be made publicly available in the 
future. The bill came into force when it received Royal Assent on June 29, 2005. 
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¢ Bill C-37, An Act to Amend the Telecommunications Act. (Before the House of 
Commons Standing Committee on Industry, Natural Resources, Science and 
Technology.) 


This enactment aims to reduce the volume of unsolicited telemarketing calls 
Canadians receive at home by providing the Canadian Radio-television and 
Telecommunications Commission (CRTC) with the ability to establish a national 
Do Not Call List (DNCL). Under the legislation, the CRTC has the power to levy 
substantial penalties against telemarketers who do not follow the rules. The OPC 
expressed its strong support for the general intent underlying this bill when it was 
first introduced in Parliament. However, Bill C-37 also sets out a list of telemarketers 
who are exempt from the CRTC’s requirements or prohibitions in relation 

to a national DNCL. The OPC expressed opposition to the inclusion of these 
exemptions. We suggested instead that the House of Commons delay the inclusion 
of any exemptions until such a time as Parliament had more fully consulted with 
Canadians on the matter, as was originally recommended by the then minister 
responsible for the Bill. This advice was supported by the majority of our provincial 
counterparts. Nevertheless, Parliament decided to incorporate exemptions. Bill C-37 
received Royal Assent on November 25, 2005, and will come into force on a day to be 
fixed by order of the Governor in Council. 


° Bill C-16, An Act to Amend the Criminal Code (impaired driving) and to make 
consequential amendments to other Act. (Before the House of Commons 
Standing Committee on Justice, Human Rights, Public Safety and Emergency 
Preparedness.) 


This enactment amends the Criminal Code to clarify that the reference to 
impairment by alcohol or a drug in paragraph 253(1)(a) of that Act includes 
impairment by a combination of alcohol and a drug. It authorizes specially trained 
peace officers to conduct tests to determine whether a person is impaired by a drug 
or a combination of alcohol and a drug and also authorizes the taking of samples 

of bodily fluids to test for the presence of a drug or a combination of alcohol and a 
drug in a person’s body. The OPC expressed support for the intent of the legislation, 
which is to make our roads safer and to protect Canadians against the effects of 
impaired driving. However, we had some concerns about the way in which the 

Bill proposed to address the problem. In particular, these concerns related to the 
effectiveness and the proportionality of the measures that were being proposed. 

One of the fundamental principles of fair information practices underlying the 
Privacy Act is that personal information should not be collected unless it can be used 
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to achieve the specific purpose for which it has been collected. Forcing people to 
provide bodily fluids is intrusive; the intrusion is compounded when the samples 
cannot, with confidence, be used to measure impairment. Nevertheless, we noted 
that if, despite these concerns, the government decided to move ahead with the 
legislation, provisions needed to be made to ensure that the bodily fluids collected 
and the results derived from tests were adequately protected. Bill C-16 died on the ° 
Order Paper at committee report stage. 


* Review of the Anti-terrorism Act. (Before the Senate Special Committee on the 
Anti-terrorism Act, and the House of Commons Subcommittee on Public Safety 
and National Security.) 


The Anti-terrorism Act received Royal Assent on December 18, 2001. It amended 

the Criminal Code, the Official Secrets Act, the Canada Evidence Act, the Proceeds of 
Crime (Money Laundering) Act and a number of other Acts, and enacted the Charities 
Registration (Security Information) Act, in order to combat terrorism. In 2005, a House 
Committee and a Senate Committee both independently undertook a comprehensive 
review of the Act, as mandated by the legislation to take place three years after it 
received Royal Assent. The OPC appeared before both Committees reviewing the 
legislation. Our remarks focused primarily on the lack of facts and evidence to 
suggest that the measures provided for by the Anti-terrorism Act are necessary. We also 
urged the Committees to critically assess the issue of proportionality and to consider 
a number of practical recommendations proposed by our Office to address the 
cumulative impact of anti-terrorism measures on the privacy rights of Canadians. 


A key Committee for the Office is the relatively new Standing Committee of 

the House of Commons on Access to Information, Privacy and Ethics (ETHI). 
Established in late 2004, this Committee is significant in that with its creation, 
Canadians now have a Standing Committee of the House of Commons dedicated 
to privacy matters. The Privacy Commissioner of Canada and other OPC officials 
appeared three times before the ETHI Committee in 2005-06. While a common 
reason for these appearances was to question us on the operations of our Office 
through examination of our Estimates and Annual Reports, Members of the 
Committee also had many questions and concerns regarding some of the key 
privacy challenges and opportunities facing Canadians. The OPC looks forward 
to a continued, productive working relationship with this Committee in the ie 
Parliament. As privacy issues continue to grow in number and complexity, it is vital 
that Parliament have a focus to examine these issues and reflect on the concerns 


expressed by Canadians. 
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Finally, a new House of Commons Advisory Panel on the Funding for Officers of 
Parliament was created this year. The new Panel was responsible for assessing and 
making recommendations on the OPC request for additional resources. The OPC 
appeared twice before this Panel to present its Business Case. 


Privacy Act Reform 


Recommendations for reform of the Privacy Act have been made ever since the first 
legislated review, which resulted in the 1987 report of the Standing Committee 

on Justice and Solicitor-General, Open and Shut: Enhancing the Right to Know and 
the Right to Privacy. Despite the fact that the report, containing more than 100 
recommendations, was unanimously supported by members of the Committee, 
none of the recommended changes have been enacted, although, in its response, the 
government committed to move on amendments by the fall of 1988. 


In his last report, for 1999-2000, then-Commissioner Bruce Phillips pointed out 
that Parliament had not turned its mind to the Privacy Act in 14 years, although 
numerous recommendations had been made during the 1990s by the Privacy 
Commissioner. He called the weaknesses of the Privacy Act 


“... all the more striking now that Parliament has passed the 
Personal Information Protection and Electronic Documents Act. This 
act (which regulates personal information handling in the private 
sector) contains many features that are superior to the Privacy Act, 
making a comprehensive review of the existing law both urgent and 
unavoidable.” . 


A detailed review of the Act, Privacy Act Reform: Issue Identification and Review, was 
completed by this office in December 1999, released in June 2000 and submitted to 
the Department of Justice in anticipation of that “urgent and unavoidable” review. 


That review has yet to take place. 


Canadians have become much more familiar with the privacy protection principles 
underlying the private sector law and no doubt expect that personal information 

in the hands of the government has at least as much protection as personal 
information in the hands of businesses. If the review of the Act was “both urgent and 
unavoidable” in 2000, it is even more so today. 
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To that end, the latest report produced by this Office focuses on the obligations of 
government institutions. This report was prepared at the invitation of the Standing 
Committee on Access to Information, Privacy and Ethics, an invitation extended 
when the OPC appeared before the Committee last fall to discuss our annual reports 
for 2004-05. Government Accountability for Personal Information: Reforming the 
Privacy Act was recently submitted to the Committee. 


The Privacy Act was introduced as, and should remain, to the extent possible, 

the companion of the Access to Information Act. The new government has made 
accountability a centerpiece of its mandate and it is our hope that the long- 
postponed review and amendment of the Privacy Act will finally take place. In 
preparing Government Accountability for Personal Information, our Office has 

been informed by the proposals for reform presented to the Committee by the 
Information Commissioner in September 2005 and the report of the Special Advisor 
to the Prime Minister, Mr. Gérard La Forest, submitted in November. 


Since the Privacy Act came into being over 20 years ago, the privacy landscape 

has become much more complex. Technological and social changes in the last 

20 years — the creation of the Internet and the World Wide Web, new information 
and communication technologies, globalization, global positioning systems, video 
surveillance, outsourcing, data mining and the commodification of personal 
information — have not just changed the landscape, they have put us on another 
planet. 


As a quasi-constitutional statute, the Privacy Act must have primacy over other 
legislation, except in the most exceptional circumstances. All federal government 
institutions must be subject to the Privacy Act — not just departments and agencies. 
Officers of Parliament, Crown corporations, the various Foundations set up in 
recent years, and other entities which carry out important functions related to 
public health and safety must also be subject to the Privacy Act. Any person, not just 
Canadian citizens or other persons present in Canada, must have the right to apply 
for access to their personal information held by a Canadian government institution. 
The definition of personal information must, in this technological and digital 

age which permits real-time surveillance, include unrecorded as well as recorded 
information about an identifiable individual. In addition, a person must be able to 
challenge in court not just a refusal of access to their personal information, but also 
inappropriate collection, use or disclosure of that information. 
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The Privacy Commissioner must have as broad a mandate under the Privacy Act as it 
does under the private sector legislation, including the power to use mediation and 
conciliation to resolve complaints, to conduct research on privacy-related issues, and 
to educate the public and government institutions about their rights and obligations. 
The duties of government institutions concerning collection, use and disclosure 

of personal information must be more clearly specified. Important policies for 
achieving the goals of the Privacy Act have been developed by Treasury Board. These 
obligations respecting data matching, the management and security of government 
information, the establishment of privacy management frameworks, the conduct of 
privacy impact assessments for new programs and guidance for protecting privacy 
in outsourcing contracts should have the authority of legislation behind them. 
Without such authority, these policies remain exposed to the vagaries of executive 
government. 


To increase accountability and transparency of government institutions with 

respect to personal information, reporting requirements need to be strengthened 
and Parliamentary committees need appropriate support and resources to review 
the personal information practices of government institutions, as well as their 
performance of Privacy Act responsibilities. Institutions must remain accountable for 
personal information they are permitted to collect, even though it may be collected 
or processed by others, especially by contractors outside of Canada. 


Although not within this reporting period, it is important to note the new 
government’s Federal Accountability Act, introduced April 11, 2006. This bill includes 
the first set of proposed amendments to the Access to Information Act, with parallel 
amendments to the Privacy Act. These amendments extend the scope of the Acts to 
include additional Crown corporations and the Officers of Parliament (including 
this Office). The government has further confirmed its commitment to move ahead 
with comprehensive reform of the Access to Information Act. This will necessarily 
require consideration of the parallel provisions in the Privacy Act. It is our hope that 
this will be the year the government finally carries out the “urgent and unavoidable” 
review and updating of the Privacy Act, not just concerning issues in common with 
the access legislation, but also including the broader range of issues addressed in 
Government Accountability for Personal Information: Reforming the Privacy Act. 


The Merger Issue 


In July 2005, former Supreme Court of Canada Justice, the Hon. Gérard V. La 
Forest, was appointed as a special advisor to the Minister of Justice to assess the 
merits of merging the offices of the Information Commissioner and the Privacy 
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Commissioner into a single office. Mr. La Forest was also to examine the merits of 


cross-appointing a single Commissioner to both functions while maintaining two 
separate Commissions. 


A shift in the structure of dealing with access to information and privacy issues at 
the federal level could have implications on several fronts, not the least of which was 
the quality of protection of the privacy rights of Canadians. 


In our formal response, delivered to Mr. La Forest in October 2005, we concluded 
that this is not the appropriate time to consider merging the two offices. In reaching 
this conclusion, we noted the general lack of scholarly literature on the merits and 
problems associated with either a “twinned” model or the current federal model. The 
decision to move towards a particular model must necessarily be based more heavily 
on assumptions than on a historical record. 


We also cautioned that the discussion about the potential framework for asserting 
access to information and privacy rights at the federal level should not detract from 
other important concerns affecting these rights. Among those concerns were an 
appropriate legislative framework, adequate resources to fulfill legislated functions, 
and a broad mix of tools and processes to foster a culture of compliance that shows 
respect for the values represented by privacy and access laws. We argued that a 
review of privacy and access to information legislation was paramount and should 
precede the discussion of organizational models. The important issue was perhaps 
not the shape of the container surrounding privacy and access to information, but 
the quality of the product inside. 


In his November 15, 2005, report, Mr. La Forest stated that the burden of persuasion 
lies with those advocating a merger of the offices of the Information and Privacy 
Commissioners or a cross-appointment of a single commissioner to both offices. 
He concluded that this burden had not been met. Each of the one- and two- 
commissioner models has advantages and disadvantages, he concluded, and in the 
abstract, neither is demonstrably superior to the other. “But considering the unique 
features of the federal access to information and privacy environments, and the 
investments that interested parties have made in the existing structure, moving to 

a single commissioner model would, in my estimation, have a detrimental impact 
on the policy aims of the Access to Information Act, the Privacy Act, and the Personal 
Information Protection and Electronic Documents Act.” 
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Public Interest Disclosures 


otecting personal information from unwarranted disclosure is an ongoing 
task for this Office. However, there are circumstances when personal 
information held by government institutions can and should be disclosed, 
even without the consent of the person to whom the information relates. Certain 
disclosures in the public interest fall into this category. 


The Privacy Act allows for “public interest” disclosures of personal information in 
limited circumstances. Section 8(2)(m) of the Act permits “disclosure of personal 
information without the consent of the individual where, in the opinion of the head 
of the institution: 


* the public interest in disclosure clearly outweighs any invasion of privacy 
that could result from the disclosure; or 

¢ disclosure would clearly benefit the individual to whom the information 
relates.” 


This provision has been used, for example, to make public details about an 
individual who is being released from custody and who poses a threat to the 
community. 


The head of the institution decides whether the public interest outweighs the right 
to privacy. The institution must notify the Privacy Commissioner that it will be 
disclosing personal information in the public interest. The Commissioner may 
express concerns with the proposed disclosure and may, if she thinks it appropriate, 
notify the individual whose information will be disclosed. However, the decision to 
release the information in the public interest, and how much to release, rests solely 
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with the head of the institution. The Privacy Commissioner has no authority to 
prevent the disclosure. 


The Privacy Act is therefore abundantly clear about allowing public interest 
disclosures. Unfortunately, the public disclosure provision is not well understood 
and, on occasion, the Act is perceived as standing in the way of safety and security 
by blocking the release of personal information. Too often we hear representatives of 
government institutions arguing that the Privacy Act prevents them from releasing 
personal information, when in fact the head of the institution could release the 
information in the public interest. This inaccurate explanation of the role of the Act 
wrongly paints the Act as the villain. 


We do have some sympathy for the predicament facing government institutions on 
this point. In some situations — for example, following a natural disaster or crime — a 
reporter may confront a spokesperson for the institution and ask for the name and 
other personal information about a victim. The spokesperson may simply err on the 
side of caution and refuse to release that information. 


We have no quarrel with this caution, since the spokesperson has no authority under 
the Privacy Act to order the release of the personal information in the public interest, 
and the decision to release should not be taken lightly in any event. Only the head of 
the institution or the head’s delegate can make the decision to release information 

in the public interest. In many cases, the information will later be released, but only 
after the head of the institution has decided that the release is appropriate. 


Our concern lies instead with the simplistic characterization of the Privacy Act 

as the barrier to disclosure. It would be more appropriate, and a more accurate 
interpretation of the Privacy Act, for the spokesperson to say that the authority to 
release personal information rests with the head of the institution, not with the 
spokesperson. We encourage government institutions to remind spokespersons to 
respond in this manner when pressed for personal information. 


Transborder Data Flows 


Last year we wrote about the concerns registered in Canada about the impact of the 
USA PATRIOT Act on data held by US based companies. The USA PATRIOT Act 
has become the symbol of the increasing concern of Canadians about the security 
of their personal information when it leaves Canada. The USA PATRIOT Act was 
passed rapidly by US Congress shortly after the events of September 11, 2001, with 
a number of provisions that were scheduled to “sunset” in five years unless the US 
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Government could persuade Congress to make them permanent. They succeeded 
in doing so in March 2006, and the controversial clauses became permanent. 
This Office has certainly expressed concerns about our own Anti-terrorism Act 
in previous Annual Reports, and noted the growing concern about the impact of 
foreign legislation on personal data that has left Canada. 


This issue has certainly caught the imagination of Canadians, and we have received 
inquiries and complaints which focus on it as a threat to the privacy of Canadians 
where transborder dataflow is an issue. It is perhaps appropriate to remind everyone 
that once data is outside of Canada, the ultimate control of it rests in the hands 

of the authorities in that state. It is subject to the Court systems in that country, 

and is accessible under local laws. This is why the European Union passed its 
Directive 95/46 on Privacy, which directs EU data protection commissioners to 
block dataflows to foreign states without “adequate” data protection. Adequate data 
protection includes not merely data protection law, but independent data protection 
authorities who can provide redress for the citizen. 


This is old hat to those who follow data protection matters, because these provisions 
caused a tremendous stir in 1990s when the Directive was first introduced, but 15 
years later we still only inching our way closer to finding solutions for disputes arising 
from global data flows. The Privacy Commissioner of Canada has agreed to sit on 

a committee of the Organisation for Economic Co-operation and Development 
(OECD) which is investigating the need for greater cooperation among independent 
authorities in handling cross border violation of data protection laws. 


This Office has dealt with complaints about cross border marketing of information, 
and it is clear that dealing with jurisdictional issues is going to be a growing 

concern in data protection, just as it is in cybercrime. The Justice Minister in the 

last Parliament had indicated his support for ratifying the Council of Europe’s 
Cybercrime Treaty, which facilitates cooperation among signatories in fighting cross- 
border crime. We need privacy matters to be included in this agreement as well, or 
we need other administrative tools such as Mutual Legal Assistance Treaties and 
Memoranda of Understanding with other states. 


We followed up the debates of 2004 on transborder data flow in early 2005. We 
wrote a letter to the President of the Treasury Board urging the federal government 
to review the implications of its outsourcing of personal information and to develop 
contractual clauses to protect personal information transferred to third parties 

for processing. In the following months we were consulted by the Treasury Board 
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Secretariat as it crafted a federal strategy in response to privacy concerns about 

the USA PATRIOT Act and the possibility that foreign legislation could reduce the 
protection of Canadians’ personal information. The review of outsourcing contracts 
among 160 federal institutions revealed that more than 80% rated their contracts as 
having “no” or “low” risk. The review also helped departments and agencies identify 
measures to further mitigate privacy risks. One of the key documents released by 
the Treasury Board Secretariat was a set of guidelines for government institutions. 
The guidelines set out rules for outsourcing activities in which personal information 
about Canadians is handled or accessed by private sector agencies under contract 
with government institutions. 


We see the federal strategy as a very positive step toward addressing Canadians’ 
concerns about the flow of their personal information across borders and the 
possible privacy risks posed by foreign legislation, or even the absence of any privacy 
legislation. Personal data increasingly circulates the globe and is an important 

part of global commerce. International data protection rules, such as those of the 
OECD or the European Union, were created to facilitate the transfer of data across 
boundaries under appropriate conditions. The recent Treasury Board guidelines 
attempt to meet the same objectives and we hope that they will be an integral part of 
a reformed Privacy Act. 


International Liaison 


Over the past year, we have had several visits from colleagues in other countries, with 
a view to sharing our experiences in the field of data protection and assisting in the 
development of data protection law. In a world of global dataflows, it is increasingly 
important that despite differences in legal approach, we achieve harmonious results 
in our expectations of business practice. As we share data about our citizens, it will 
be important that we can count on the oversight of similar authorities outside our 
own jurisdiction, who will look after the protection of the privacy of Canadians. 


In October-November we hosted a policy analyst from the Commission nationale 

de V’informatique et des libertés (CNIL), the data commission of France. We were 
honoured by a visit by the President of the CNIL, M. Alex Tiirk, and compared our 
different approaches to enforcement of law. In December we hosted two senior 
officers from the Mexican Federal Institute for Access to Public Information, who 
were interested in learning how our regime functions at the ground level, because 
Mexico is contemplating the enactment of data protection law, and indeed has a bill 
in Congress. Following their visit, we prepared for a much larger delegation who 
ultimately arrived for a three day visit in May 2006. 
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We look forward to hosting the International Conference of Data Protection and 
Privacy Commissioners in September 2007, where many world experts in privacy 
and data protection will gather in Montreal. This is a tremendous opportunity for 
Canadians in government, business, civil society and academe to gather and benefit 
from the assembled expertise. We will continue to work with colleagues to develop 
the individual exchange program, a highly useful and relatively inexpensive way to 
develop harmonized approaches, share knowledge, and build effective relationships. 


Radio Frequency Identification Devices (RFIDs) 


We have been analyzing the potential impact of Radio Frequency Identification 
Devices on personal privacy, and how our legislation would apply. The devices have 
potential for widespread use in consumer products in Canada. With respect to the 
public sector, there have been suggestions to put RFIDs in passports and border 
crossing cards. We put a fact sheet up on our web site, and are working on further 
guidance which will appear this coming year. 


Videosurveillance Guidelines 


‘The Office has been working with the Royal Canadian Mounted Police (RCMP) 

to develop video surveillance guidelines for the use of cameras to monitor public 
spaces. We have put the guidelines on our web site, and continue to study both 
increasing use of cameras, and the technical advances that have helped make such 
surveillance so prevalent now, not only in public spaces, but in retail environments, 
the workplace, and near all kinds of facilities that have importance with respect to 
critical infrastructure protection, from gas pipelines to nuclear sites. The increasing 
power of these cameras, the decreasing costs of data storage, the development 

of good facial recognition and computer programs that do movement pattern 
recognition, coupled with the ease with which even remote cameras can now be 
linked to the world wide web have certainly created the potential of a powerful web 
of surveillance. We are witnessing an increasing appetite for video-surveillance in 
Canada and will be developing further guidance on the issue. 


Identity Management and the War on Crime and Terror 


One of the recurrent themes of this year’s research and policy analysis has 

been identity management. This Office has written about this issue from many 
perspectives over the past twenty-three years, from discussions on the use of the 
Social Insurance Number to the OPC’s submission on biometric identity cards. 
This year, we decided that identity management will be a focal point for next year’s 
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research and policy agenda. Here are a few of the experiences of 2005-06 that have 
led us to this conclusion. 


We have been immersed in issues surrounding border security, whether through the 
audit we conducted of the Canada Border Services Agency which is described later 
in this report, through commenting on speculation about the proposed Canada- 

US border card, or in our questions to Transport Canada on no-fly lists. While it is 
perfectly legitimate for sovereign states to want to positively identify who is crossing 
into their countries, we are concerned that once a card is introduced, it will be 
swiped or presented in a host of new situations. It is our observation that when we 
are frightened about potential terrorist and criminal activity, the impulse is to throw 
the lights on and identify everything, like a child frightened in the dark. It has not 
been made clear to us that uniquely identifying each person will enable us to predict 
who is good or bad, although it may indeed help to prevent fraud in some cases. 
Nevertheless, teasing apart the reasons for new cards, new identity schemes, new 
registers of people, and responding to the fresh losses of anonymous transactions in 
our daily lives is occupying a significant part of our time. 


It seems obvious to observe, in relation to the no-fly list for instance, that surely if 
a person is too dangerous to be allowed to sit in an aircraft, they might be also too 
dangerous to sit on a subway or board a train. Where are we going with this kind 
of thinking? As we examine the application in other jurisdictions of RFID chips in 
motor vehicle licence plates, reporting on where and when vehicles are traveling on 
the streets and highways, is it not natural to inquire when we will see these devices 
on people? Someone has to ask these questions, perhaps it is our duty. 


With respect to the questions we sent to Transport Canada on the no-fly list issue, the 
Commissioner stated publicly in August 2005 that this could be a “serious incursion 
into the rights of travellers in Canada, rights of privacy and rights of freedom of 
movement.” In May 2006 we received a privacy impact assessment for the project and 
it is currently under review. 


At the routine, day to day level, the federal government is working to improve 
electronic service delivery. Service Canada is working to roll out integrated service 
delivery, responding to the needs of Canadians for something that feels like the 
one-stop shopping they now get at the supermarkets. The architecture behind 
these offerings will continue to challenge us as we try to ensure streamlined process 
without facilitating the development of a Panopticon in government, where the 
central authority can see everything. 
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Technology leaders such as Microsoft and IBM are presenting new schemes for 
identity management, to deal with issues of fraud, SPAM, and consumer usability, 
among others. Telecommunications companies, responding to our own concerns 
about providing personal information only to the person it concerns, are initiating 
newer and tougher authentication regimes. Banks are being asked by government to 
provide more data about individuals and their transactions. We have examined the 
Financial Crimes Reporting legislation, in anticipation of the review of the Act in 
2006, and we are concerned about the degree of surveillance of financial transactions 
which this Act has mandated. Who among Canadians have any idea where their 
financial data is going, and what is happening with the information reported by 
banks, accountants, lawyers, and other private sector players about their customers? 
Even if the data is perfectly managed, and we had time to audit the relevant players 
to determine this, the point is that in this democracy there are very few who 
understand the extent of the growth of surveillance and data gathering, and that in 
itself is a worry. 


Sometimes when we meet with our colleagues in government to discuss new 
initiatives, we ask questions that may seem a little offensive. Canada is not by any 
means an oppressive state, and officials in the federal government are absolutely 
impressive in their desire to maintain privacy protections, to understand the impacts 
of complex technological implementations, and in their respect for human rights 
and civil liberties. But the price of freedom is, indeed, eternal vigilance. Where will 
the thirst for identification and transactional surveillance lead us? Is it possible for 
us to manage all of this disparate activity and come up with an approach to identity 
and authentication that we could dare to call comprehensive? 


We are certainly going to try. There has been a lot of work done in other 
jurisdictions. We are encouraged that the Treasury Board Secretariat is looking at 
some of these issues here in Canada, and we hope to play our part in contributing 
the privacy perspective to the dialogue. Indeed, identity is not that easy. 
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COMPLAINTS 


ince 1983 this Office has investigated complaints dealing with personal 

information held by federal government departments and agencies. The 

Privacy Act governs the collection, use, disclosure, retention and disposal of 
personal information in the administration of government programs and provides 
individuals with the right of access to their government-held personal information. 
The Privacy Commissioner of Canada normally deals with complaints filed by 
individuals, but she may initiate a complaint and investigate a situation where she 
has reasonable grounds to believe the Privacy Act has been violated. 


The Privacy Commissioner is an ombudsman who resolves complaints through 
mediation, negotiation, and persuasion whenever possible. However, the Act gives 
the Commissioner broad investigative powers to carry out her mandate. She may 
subpoena witnesses, compel testimony, and enter premises to obtain documents 
or to conduct interviews. The Commissioner can and does recommend necessary 
changes to the information-handling practices of government institutions. 


Definitions of Complaint Types 


Complaints received in the Office are categorized into three main groups: 


Access: 


* Access — All personal information has not been received, either because 
some documents or information are missing or the institution has applied 
exemptions to withhold information. 


* Correction/Notation — The institution has failed to correct personal 
information or has not placed a notation on the file in the instances where it 
disagrees with the requested correction. 
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Language — Personal information was not provided in the official language 
of choice. 


Fee — Fees have been assessed to respond to a Privacy Act request; there are 
presently no fees prescribed for obtaining personal information. 


Index — INFOSOURCE '! does not adequately describe the personal 
information holdings of an institution. 


Privacy: 


Collection — Personal information collected is not required for an operating 
program or activity of the institution; personal information is not collected 
directly from the individual concerned; or the individual is not advised of 
the purpose of the collection of personal information. 


Retention and Disposal — Personal information is not kept in accordance 
with retention and disposal schedules (approved by the National Archives and 
published in INFOSOURCE): either destroyed too soon or kept too long. 


In addition, personal information used for an administrative purpose must 
be kept for at least two years after the last administrative action unless the 
individual consents to its disposal. 


Use and Disclosure — Personal information is used or disclosed without 
the consent of the individual and does not meet one of the permissible 
disclosures without consent listed in section 8(2) of the Act. 


Time Limits: 


1 


Time Limits — The institution did not respond within the statutory limits. 


Extension Notice — The institution did not provide an appropriate rationale 
for an extension of the time limit, applied for the extension after the initial 
30 days had been exceeded, or applied a due date more than 60 days from 
date of receipt. 


Correction/Notation - Time Limits — The institution has failed to correct 
personal information or has not placed a notation on the file within 30 days 
of receipt of a request for correction. 


INFOSOURCE is a federal government directory that describes each institution and the banks of 
information (groups of files on the same subject) held by that particular institution. 
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Complaints Received between April 1, 2005 and March 31, 2006 

The Office received 1,028 complaints in 2005-06, 549 fewer complaints than the 
previous year. This 35% decline from the previous year reflected lower numbers of 
Access, Use and Disclosure and Time Limits complaints. As opposed to last year, the 
Office did not receive any groups of complaints, which may also account in part for 
the lower number of complaints received. 


Access 39) 38.00 
Collection 25 2.40 
Correction-Notation 44 4.30 
Correction/Notation - Time Limits 9 0.90 
Extension Notice 22 2.10 
Language 1 0.10 
Retention and Disposal 10 1.00 
Time Limits 411 40.00 
Use and Disclosure 115 11.20 
Total 1,028 100.00 


As in previous years, the most common type of complaint concerned institutions 
not meeting the 30-day timeframe specified in the Act to respond to requests for 
access to personal information. Time limit complaints, along with complaints about 
denial of access to personal information and inappropriate use and disclosure of 
personal information, comprise 89% of the complaints received. In the 2004-05 
fiscal year the distribution was similar, with these complaints constituting 85% of 
the total. 


Dy, 


ANNUAL Report TO PARLIAMENT 2005-2006 — Report ON THE Privacy ACT 


Top Ten Institutions by Complaints Received 
The following table represents the institutions that received the greatest number of 
complaints in the fiscal year ending March 31, 2006. 


Time 
Organization Limits 


Correctional Service Canada 


Royal Canadian Mounted Police 165 a5 121 9 
Immigration and Refugee Board * 121 32 85 4 
Canada Revenue Agency LW, 38 37 17 
Citizenship and Immigration Canada 60 32 my) 1 
Canada Post Corporation 42 15 17 10 
National Defence 4] a 21 7 
Human Resources Skills Development 35 10 5 20 
Canadian Security Intelligence Service 35 30 5 0 
Canada Border Services Agency 34 ee 19 3 
Others 213 111 62 40 
Total 1,028 436 442 150 


* A significant portion of complaints regarding this institution were submitted by one individual in 
the course of dealing with the Immigration and Refugee Board. 


The number of complaints filed against institutions does not necessarily mean that 
these institutions are not compliant with the Privacy Act. Because of their mandate, 
some of these institutions hold a substantial amount of personal information about 
individuals and are therefore more likely to receive numerous requests for access 

to that information. Holding a large amount of personal information increases 

the likelihood of complaints about the institution’s collection, use and disclosure, 
retention and disposal of personal information, and the manner in which it provides 
access to that information. 
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Complaints Received by Institution 

This table shows the actual number of all of the complaints lodged against the 
various institutions and agencies that were received in the fiscal year ending March 
31, 2006. 


Agriculture and Agri-Food Canada 32 
Canada Border Services Agency 34 
Canada Economic Development for Quebec Regions 13 
Canada Firearms Centre ] 
Canada Post Corporation 7) 
Canada Revenue Agency 92 
Canadian Air Transport Security Authority 2 
Canadian Food Inspection Agency 1 
Canadian Heritage ] 
Canadian Human Rights Commission 4 
Canadian Security Intelligence Service 35 
Citizenship and Immigration Canada 60 
Commission for Public Complaints Against the RCMP 1 
Correctional Investigator Canada 1 
Correctional Service Canada 190 
Elections Canada 1 
Export Development Corporation 8 
Fisheries and Oceans 1 
Foreign Affairs and International Trade Canada 33 
Health Canada 18 
Human Resources and Skills Development Canada 35 
Immigration and Refugee Board 121 
Indian and Northern Affairs Canada 3 
Indian Residential Schools Resolution Canada 1 
Industry Canada 5 
Justice Canada 29 
Library and Archives Canada 7 
National Defence 4] 
National Gallery of Canada 1 
National Parole Board 4 
National Research Council Canada 2 
Office of the Commissioner of Review Tribunals ] 
Pacific Pilotage Authority Canada 1 
Pension Appeals Board Canada 2 
Privy Council Office 1 
Public Safety and Emergency Preparedness Canada 1 
Public Service Commission Canada 7 
Public Works and Government Services Canada 6 
Royal Canadian Mounted Police 165 
Social Development Canada 13 
Statistics Canada 3 
Transport Canada 3 
Veterans Affairs Canada 6 
Total 1,028 
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Complaints Received by Origin 
From April 1, 2005 to March 31, 2006 


The following table shows the province of origin of the complaints received in 

the reporting period. It should be noted that some complaints were received from 
persons living outside Canada. Canadians living outside the country whose personal 
information is held by the Canadian government are also covered by the Privacy Act. 


Quebec 249 24.00 
Ontario 225 22.00 
British Columbia 182 18.00 
NCR 159 15.00 
Alberta 68 7.00 
Manitoba 53 5.00 
Saskatchewan 35 3.00 
International 17 2.00 
New Brunswick 15 1.50 
Nova Scotia 16 1.60 
Newfoundland 5 0.50 
Prince Edward Island 2 0.20 
Yukon Territory 2 0.20 
Total 1,028 100.00 


Almost 80% of complaints originated in the provinces of Quebec, Ontario and 
British Columbia, as well as in the National Capital Region. This pattern is consistent 
with what we have seen over the last five years in that Quebec, Ontario, and 

British Columbia have, with one exception, been the source of the vast majority of 
complaints received. The exception was in the 2003-04 year, when Alberta bumped 
Ontario out of third place. 
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Complaints Completed between April 1, 2005 and March 31, 2006 
In the past fiscal year, we closed 1,040 complaints, approximately the same number 
of complaints that we received in that year. 


Despite closing as many Privacy Act complaints as received, the Office is carrying 
a significant number of ongoing cases —1,263 at fiscal year-end. A major Business 
Process Review of the Branch was finalized at the beginning of the year to 
establish appropriate resource levels and to find solutions to our aging caseloads. 
A requirement for additional resource levels was identified and intensive staffing 
activities are underway to recruit, hire and train additional investigators. We are 
determined to deal with the backlog of cases within two years. 


Definitions of Findings and other Dispositions under the Privacy Act 


The Office has developed a series of definitions of findings to explain the outcome of 
its investigations under the Privacy Act. 


Early resolution: applied to situations in which the issue is dealt with before a 
formal investigation is undertaken. For example, if an individual complains about 
an issue that the Office has already investigated and found to be compliant with the 
Privacy Act, we explain this to the individual. We also receive complaints in which a 
formal investigation could have adverse implications for the individual. We discuss 
the possible impact at length with the individual and should he or she choose not to 
proceed further, the file is closed as “early resolution”. 


Not Well-founded: the investigation uncovered no or insufficient evidence to 
conclude that the government institution violated the complainant’s rights under the 
Privacy Act. 


Well-founded: the government institution failed to respect the Privacy Act rights of 
an individual. 


Well-founded/Resolved: the investigation substantiated the allegations and the 
government institution has agreed to take corrective measures to rectify the problem. 


Resolved: after a thorough investigation, the Office helped negotiate a solution 
that satisfies all parties. The finding is used for those complaints in which well- 
founded would be too harsh to fit what essentially is a miscommunication or 
misunderstanding. 
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Settled during the course of the investigation: the Office helped negotiate a 
solution that satisfies all parties during the investigation, but issues no finding. 


Discontinued: the investigation was terminated before all the allegations were 
fully investigated. A case may be discontinued for any number of reasons —the 
complainant may no longer be interested in pursuing the matter or cannot be 
located to provide additional information critical to reaching a conclusion. 


Findings by Complaint Type 


The following charts show the outcome of our investigations of the different types of 
complaints we receive. The first chart represents all types of complaints; the second 
represents access and privacy complaints, and the third represents complaints strictly 
related to time limits. This is the first time we have isolated our statistics in this way 
to demonstrate the significant number of complaints we receive that are related 
strictly to time limits. 


Complaints (All Types) Closed 
From April 1, 2005 to March 31, 2006 


Settled in Well- 
Early Not well- course of Well- | founded- 
Discontinued | Resolution | founded | Resolved | investigation | founded | Resolved | Total 
54 12 143 12 63 1 23 308 


Access 

Collection 2 2 19 0 9 1 0 33 

Seg 24 1 3 0 5 0 0 33 

Notation 

Correction/ 

Notation - 0 0 0 0 0 5 0 5 

Time Limits 

see 2 1 37 0 0 4 Oe 
otice 

Language 0 0 0 1 0 0 0 ] 

Retention 

and 0 0 2 0 4 1 0 i 

Disposal 

Time Limits 47 5 22 11 8 395 0 488 

Use and 12 2 51 2 29 25 0 121 

Disclosure 

Total 141 23 277 26 118 432 23 1,040 


32 


ComPLaInTs 


Access and Privacy Complaints Closed 
From April 1, 2005 to March 31, 2006 


Access 54 12 143 


Settled in 
course of Well- = 
Discontinued | Resolution | founded | Resolved | investigation | founded | Resolved 
12 1 


63 23 308 
Collection 2 2 19 0 9 1 0 33 
Correction- 
Notation 24 1 3 0 5 0 0 33 
Language 0 0 0 1 0 0 0 1 
Retention 
and 0 0 2 0 4 1 0 7 
Disposal 
Use and 
Dicdactre 12 2 51 2 29 25 0 121 
Total 92 7 218 15 110 28 23 503 


Clearly, there are far more not well-founded complaints than well-founded 
complaints: 218 and 51 respectively. This includes well-founded resolved. 

In addition, a significant number of complaints are resolved in some way 
(discontinued, early resolution, resolved or settled in the course of investigation): 
234 out of 503 complaints, or 47%. Another way of viewing this is that only 10% 
of complaints to our Office under the Privacy Act are well-founded. We believe this 
speaks well for overall compliance with the Act by federal institutions. 


Appendix 1 provides a detailed breakdown of access and privacy complaints closed 
by department. 
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Time Limit Complaints Closed 
From April 1, 2005 to March 31, 2006 


Settled in Well- 


course of Well- | founded- 
investigation | founded | Resolved 


Correction/ 

Notation - 0 0 0 0 0 5 0 5 
Time Limits 

Extension 

Notice 2 1 37 0 0 4 0 44 
Time Limits 4] 5 22 11 8 395 0 488 
Total 49 6 59 11 8 404 0 537 


It is important to note that of a total of 537 complaints, 75% of these were well- 
founded. By their very nature, the majority of Time Limit complaints are well- 
founded. Organizations have 30 days from the date of receipt to respond to 

requests from individuals for access to their personal information. Individuals 

do not complain unless there has been a delay in responding to their requests. 

The exceptions to well-founded findings are as a result of appropriately applied 
Extension Notices to allow for an additional 30 days to respond and instances where 
the complainants did not allow for mailing time; e.g. a request must be received by 
the institution before starting the 30-day count. 


The OPC remains concerned, however, about the numbers of Time Limit 
complaints lodged against some institutions. The OPC is aware that some of these 
institutions have taken steps to address resourcing deficiencies. Experience shows 
that public service staffing takes considerable time, as does training of new staff. 
There is therefore some lead time between identifying a requirement for resources 
and having that translate into increased productivity and a decrease in backlogs. 
The OPC will continue to monitor and assess compliance with the Time Limit 
requirements of the Privacy Act in the coming year. 


Appendix | provides a detailed breakdown of time limit complaints closed by 
department. 
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Complaint Investigations Treatment Times - Privacy Act 


The following tables show the average number of months taken to complete a 
complaint investigation, from the date the complaint is received to when a finding is 
made. The first table breaks this down by finding, the second by complaint type. 


By Finding . 
For the period between April 1, 2005 to March 31, 2006 


Average Treatment Time in Months 


Early Resolution 3.61 
Well-Founded 7.18 
Not Well-Founded 13.22 
Discontinued 8.96 
Settled in the Course of Investigation 16.46 
Well-Founded, Resolved 23.09 
Resolved 14.27 
Overall Average 10.49 
By Complaint Type 


For the period between April 1, 2005 to March 31, 2006 


Complaint Type Average Treatment Time in Months 


Correction/Notation - Time Limits 9.20 * 
Extension Notice 8.45 
Time Limits 6.49 
Access 15.14 
Language 25.00 ** 
Use and Disclosure 14.25 
Collection 14.64 
Retention and Disposal 23.86 
Correction/Notation 9.73 
Overall Average 10.50 


e The treatment time for this complaint type is based on five cases. 


oad The treatment time for this complaint type is based on one case only. 


The treatment times reflected above are of concern since our average time elapsed 
from the date of complaint to the date of finding is ten and a half months. The 
breakdown by finding shows that complaints that require full investigation — that is, 
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the complaints that result in findings of well-founded/resolved, resolved, not well- 
founded or settled — take on average more than a year to complete. The delay in 
completing settled complaints reflects the long standing practice of this Office not 
to settle cases until the investigation has been finalized. However, we are pleased to 
report that we have changed this practice and now a case can be settled at any point 
during the investigation, which should reduce treatment times for settled cases. 


Follow-up after Investigations 

Once a complaint is investigated and completed, the story does not necessarily end 
there. All complaints dealing with improper collection, use, disclosure and retention 
that are well-founded are sent to the Audit and Review Branch for its review. This 
allows the Branch to identify any trends and patterns dealing with privacy breaches 
and use this information in planning and developing its audits for the next year. 


Select Cases under the Privacy Act 


The following summaries provide a sample of the types of complaints received and 
the approach taken by this Office to address various issues with regard to personal 
information protection in the public sector. These cases demonstrate how important 
it is for government institutions and agencies to be ever vigilant in handling personal 
information and what can go wrong when this does not occur. 


Subscribers required to provide information to renew e-mail news subscription 


A subscriber to an e-mail media news service complained that he had to 
provide more information than was necessary in order to re-subscribe. It was 
the Department of Foreign Affairs and International Trade (DFAIT) that offered 
the subscription service. Specifically, the complainant objected to providing his 
postal code, telephone number and company affiliation. He also was upset that 
although DFAIT’s privacy notice said the provision of information was voluntary, 
it was actually obligatory. 


The Office learned that DFAIT had been asking Canadian subscribers to its e- 
mail media releases to provide their e-mail address, city, province, postal code, 
telephone number and company affiliation. International subscribers were only 
being asked for their e-mail address and country of origin. We confirmed that the 
on-line subscription application would not accept the subscription without this 
information. 
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DFAIT explained that telephone numbers are required so that the department can 
contact subscribers in the event of any technical problems with e-mail addresses. 
Postal code and company affiliation information is required so that some media 
releases can be targeted to a particular region or a particular type of business. 


Our Office concluded that DFAIT was allowed under the Act to collect the 
subscriber information in order to facilitate access to and distribution of the media 
releases. The complaint was therefore considered to be not well-founded. However, 
we were pleased that DFAIT agreed that the use of the word “voluntary” in its 
privacy notice was somewhat misleading; it was, in fact, the participation in the 
subscription activity itself that was voluntary. DFAIT subsequently changed the 
notice to make it more accurate. 


Unnecessary requirement for a social insurance number 


A caregiver complained that she had to give her social insurance number 
(SIN) to the father of a child in her care. It was required in order for the father 
to receive compensation under the Department of National Defence's (DND) 
Family Care Assistance (FCA) program. 


Under DND’s FCA program, certain members of the Canadian Forces can be 
reimbursed for child care costs when on duty away from home. In order to receive 
the benefit, members have to submit receipts and complete a DND form, which 
requests information concerning the caregiver, including the caregiver’s name, SIN 
or business number. 


During our investigation, DND explained that there was no actual requirement for 
the caregiver’s SIN under the FCA program. It therefore agreed to change its form to 
reflect this. In the meantime, DND instructed its staff not to ask for the SIN. DND 
also confirmed that the father in question had not provided the caregiver’s SIN on 
the form. 


The caregiver was pleased with this outcome, and the matter was considered settled. 
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Human rights complaint investigation prompts release of employee information 


An employee of the Canada Post Corporation (CPC) complained that the CPC 
had told another organization that she had taken disability leave from her job. 


Our Office learned that the CPC employee had initiated a human rights complaint 
against her employer on the issue of duty to accommodate based on a medical 
disability. During the CPC’s investigation into the circumstances that led to the 
human rights complaint, a concern emerged as to whether the employee had held 
another job while on disability leave from the CPC. 


In accordance with the basic principles of procedural fairness in the conduct of 
any investigation, an investigator is obligated to explain the nature and scope of the 
matter under investigation in order to elicit accurate and relevant information. 


In order to check the facts, the CPC contacted the other organization to inquire 
about the individual’s employment. The CPC informed the organization that it was 
investigating a human rights complaint filed against it based on a medical disability 
and the type of information it was seeking. Before releasing any of the complainant’s 
information to the CPC, the other organization requested her consent and referred 
to her having taken disability leave. However, we determined that this statement was 
an assumption on the organization’s part as there was no evidence that anything was 
said by the CPC about the complainant being on disability leave. 


As this individual’s information, which the CPC gave to the organization, was 
necessary and directly related to the conduct of the human rights investigation, our 
Office concluded that the complainant’s privacy rights were not affected and this 
matter was not well-founded. 


Collection officer did not divulge debtor personal information 


An individual complained that a Canada Revenue Agency (CRA) collection 
officer improperly disclosed her personal information to another person. 


Our Office learned that the complainant owed the CRA for overpayment of the 
Canada Child Tax Benefit (CCTB). She had been entitled to the benefit while she 
was married. However, she continued to receive the benefit following her divorce, 
even though she had not been awarded custody of her children. The CRA discovered 
the overpayment when her ex-husband and mother-in-law, who was the children’s 
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caregiver, applied for the benefit. The CRA was able to recover a portion of the 
overpayment but, after a while, its letters requesting payment of the remainder of the 
debt were returned unopened. 


A CRA collection officer then reviewed the file, and phoned the mother-in-law, 
whose name was on record as the current recipient of the CCTB. Our Office was 
informed by the collection officer that she identified herself to the mother-in-law 
and stated that she was trying to track down the daughter-in-law’s current contact 
information. The complainant maintained that the collection officer then divulged 
her personal tax information concerning the CCTB. However, both the CRA 

officer and the mother-in-law denied this. Both maintained that the mother-in-law 
immediately guessed why the officer was trying to contact the daughter-in-law, and, 
upon being questioned, the officer said she could not disclose any details. 


Under the Income Tax Act, CRA collection officers have been delegated responsibility 
for collecting tax debts owed to the Government of Canada. In this instance, the 
evidence indicated that the CRA’s collection officer did not provide any details 
regarding the complainant or her tax file to the complainant’s mother-in-law. In 

our view, the Collections Officer followed the basic principles of an investigator’s 
obligations of procedural fairness. The person merely introduced herself as a CRA 
Collections Officer and requested contact information for the complainant. Our 
Office therefore considered the complaint not well-founded. 


PSC discloses information in an audit 


Three individuals complained that the Public Service Commission (PSC) 
disclosed information about them in an audit that it had conducted and 
released to the public. 


The PSC audited the staffing actions of a small government organization. In its 
report of findings, it cited examples of specific staffing actions that it had examined. 
Our Office found that, while the report did not contain any names, it provided 
enough detail about some specific cases that the individuals could be identified. 
Furthermore, as the audit was made public, its findings were reported in the media. 


Audits are generally negative in nature, and it is not unusual that they should 
contain examples of scenarios portrayed in negative terms. This is not problematic 
when speaking of staffing processes for federal institutions with hundreds of 
employees in particular job classifications. However, when it is a small institution, 
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it is a different matter. Furthermore, calling into question the selection process 
of a position when the individual is identifiable directly reflects on the person’s 
competence and qualifications. 


Our Office concluded that the information released by the PSC in its audit was 
clearly the individuals’ personal information and should not have been disclosed 
without each person’s consent. The complaints were therefore well-founded. 


Our Office is pleased to report that the PSC now requires all of its audits to be 
reviewed by its Access to Information and Privacy Branch before they can be released 
to determine if they contain information which is subject to the Privacy Act. 


Government has right to monitor use of its e-mail systems 


A Canada Border Services Agency (CBSA) employee was annoyed that each 
time he logged on to his CBSA computer system, he had to agree to an 

online statement or else be denied access to the system. The statement in 
question indicates that the CBSA may monitor the use of its systems. The 
complainant maintained that the use of e-mail should receive the same privacy 
considerations as use of the telephone. In his view, monitoring his e-mails 
violated his privacy rights. 


Our Office ascertained that the CBSA’s monitoring policy is drawn from two 
Treasury Board policies: the Government Security Policy and the Policy on the Use 
of Electronic Networks. These policies clearly state that government departments 
must conduct active monitoring and internal audits of their security programs. 

As such, electronic networks may be monitored for operational reasons and for 
assessing compliance with the policies. While normal routine analysis does not 
involve reading content, if due to routine analysis or a complaint the institution 
reasonably suspects that an individual is misusing the network, the matter is referred 
for investigation and action that may involve special monitoring and/or reading 
the content of the e-mails. In this case, the CBSA confirmed that the complainant’s 
personal e-mails were never read. 


The CBSA pointed out that e-mail is a corporate communications tool provided 
to employees for the purpose of conducting official government business. The 
department allows limited personal use when it complies with CBSA’s policies and 
legislation, and when employee performance is not adversely affected. 
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Our Office concluded that the CBSA displayed fairness and transparency by 
informing its employees of its monitoring practices through the online statement 
and by making the electronic network policy guidelines readily available on its 
intranet. Employees therefore have clear expectations of the level of privacy they 
can expect from the employer. Our Office determined that the complaint was 
not well-founded. 
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Incidents under the Privacy Act 


In addition to individual complaints, our Office investigates incidents of 
mismanagement of personal information. These are typically brought to our 
attention from various sources including the media and directly from institutions 
themselves, and may involve matters of improper collection, use or disclosure of 
personal information. They often highlight a systemic issue, or an unrecognized 
privacy breach that needs to be corrected as soon as possible. Last year, the Office 
completed 54 such investigations. 


There were a number of incidents involving computer theft or briefcase theft, 
three incidents involved information on shared computer drives and two incidents 
involved the sale of fax machines that retained personal information in a memory 
component. These cases are described below. 


Thermofax rolls containing personal information sold by Crown assets 


There have been a couple of incidents in which fax machines purchased 

at Crown Assets Distribution Centre sales were found to hold rolls that still 
contained personal information. For example, in 2005, Human Resources and 
Skills Development Canada (HRSDC) reported to our Office that a member of 
the media had obtained a thermofax roll containing the names and/or Social 
Insurance Numbers of 65 individuals. A thermofax roll comes in a cartridge 
that is loaded into the fax machine. It contains a combination of a thin sheet 
of paper and a clear film-like substance. When the paper on the cartridge has 
all been used and the cartridge needs to be replaced, the used film has the 
negative image of every single fax that came through that machine from the 
time the roll was installed until it was removed. The thermofax roll had been 
sold as part of a fax machine at a Crown Assets sale and was later acquired 
by an individual who passed the roll on to the media. Following HRSDC's 
investigation, the purchaser assured officials that he had destroyed the 
thermofax roll and all records that had been retrieved from it. 
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HRSDC took several steps to ensure that this type of situation does not recur. An 
amended policy was circulated to HRSDC, Social Development Canada and Service 
Canada that reinforced the need for the inspection of business equipment being 
declared surplus and the need for the removal and suitable destruction of ‘memory 
instruments. Officials agreed to undertake a complete physical inventory and 
reconciliation of all fax machines. They also contacted Crown Assets to retrieve any 
unsold equipment of this type to check it for personal information. Our Office was 
satisfied that all appropriate action had been taken to remedy the situation and to 
prevent future occurrences. 


However, during our investigation, we discovered that two fax machines with 
thermofax rolls intact and originating from the Canada Revenue Agency (CRA) had 
also been sold by Crown Assets. Again, the staff was simply unaware of the need to 
sanitize such equipment. CRA too has amended its policies and procedures with 
respect to disposal of equipment with memory capability. 


Given the far-reaching implications of this matter and the likelihood that every 
department and agency is using some type of equipment with memory that requires 
special disposal, our Office advised the Information, Privacy and Security Policy 
Directorate at the Treasury Board Secretariat. It too is pursuing the matter and will 
be issuing a bulletin to all government departments and agencies. 


In conclusion, this highlights the importance of all institutions ensuring that 
personal information is properly erased from electronic data storage devices. The 
subject is not straightforward but there are three ways for “media sanitization” or 
destruction of electronic data: 


¢ Overwriting — overwriting with 1s and 0s where the data was located 
* Degaussing — magnetically erasing the data with an electric degausser 
¢ Destruction — physical destruction of the storage medium 


Two technical documents provide advice on these topics: 

* Communications Security Establishment Clearing and Declassifying 
Electronic Data Storage Devices, available online at http://www.cse-cst.gc.ca/ 
documents/publications/gov-pubs/itsg/itsg06.pdf 

¢ U.S. Department of Defense Standard 5220.22-M — Advising Users on 
Computer Systems Technology, available online at http://www.qsgi.com/ 
usdod_ standard dod 522022m.htm 
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Although these documents do not provide specific guidance on the destruction of 
thermofax rolls, the general techniques outlined in the documents (e.g. shredding) 
should be readily adaptable. 


Laptop with NCC festival security-pass information stolen 


An incident concerning computer theft occurred in the spring of 2004, 
involving a laptop computer and related accessories stolen from a National 
Capital Commission (NCC) facility. The laptop contained personal information 
consisting of two security databanks for security passes to various NCC festivals. 
The information, including names, photos, dates of birth, occupations and 
names of employers, was protected by two levels of passwords. 


The NCC’s internal investigation revealed that there had been major construction 
work going on in the building in question when the laptop was stolen. More people 
than normal had access to the premises where the computer was located, and it was 
very difficult to ascertain who might have taken it. The NCC undertook to increase 
the level of security in its facility. Our Office confirmed that the NCC also sent out 
letters to the employees whose information was compromised, referring them to a 
number of websites, including ours, for information on how to protect themselves 
from identity theft. They were also referred to the NCC’s Access to Information and 
Privacy Office for further advice. In addition, our Office recommended to the NCC 
that it make an archive copy of this particular Information Bank in order to prevent 
any future loss in cases of theft or destruction of equipment. 


Briefcase and knapsack containing offender information stolen from trunk of car 


During the winter of 2005, two Correctional Service Canada (CSC) employees 
put a locked briefcase and a knapsack in the trunk of their personal car after 
leaving a meeting. Upon arriving home, they did not remove the items from 
the trunk. Two days later, one of the employees parked the vehicle at a mall, 
and upon return, discovered that it had been broken into. The next day, both 
employees checked the trunk and found that the briefcase and knapsack were 
missing. They immediately notified the RCMP and their employer. The RCMP did 
not conduct an investigation as CSC was to conduct its own. 


Among the missing documentation was a report that contained information about 
eight federal offenders. CSC advised only two of the offenders about this incident, 
as the others were deceased. CSC’s review concluded that it was not appropriate to 
transport protected information in a knapsack, and that neither the car trunk nor 
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the briefcase is an approved storage container for protected information. A briefcase, 
however, can be used to transport such information. In addition, the employees 
responsible for the protection of the information should have removed it from 

the vehicle when they reached their destination. As a result of this incident, CSC 
decided to establish more specific guidelines to provide direction concerning the 
transportation and storage of information outside of CSC premises. 


DND employee finds own grievance information on shared computer drive 


There have been a number of incidents regarding shared computer drives 
that resulted in personal information being accessible to people with no right 
to see it. In one instance a DND employee discovered a grievance chart ona 
shared drive. On the grievance chart was his name, the file number assigned 
to his grievance complaint and the status of his grievance. Similar information 
appeared on the list about other grievers as well. 


During its investigation into the matter, DND learned that the information was 
originally on a protected drive with access shared on a controlled basis, limited to 
people who needed the information in order to do their jobs. At one point, servers 
were migrated, thus removing the firewall protection and making the information 


available on a shared drive for a limited time. This resulted in the employee being 
able to find the list. 


Once DND was notified of the problem, it took immediate steps to remove and 
destroy the list. The grievance list has since been modified so that it no longer 
contains the identity of the grievers. DND reminded the group responsible for 

the list of the need to protect personal information. It also wrote to the employee, 
informing him of the situation that led to his information becoming available on the 
shared network. DND also advised him of his right to file a formal complaint with 
our Office. 
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Public Interest Disclosures under the Privacy Act 


Heads of government institutions have the discretion to disclose personal 
information without an individual’s consent when the disclosure benefits that 
individual or when a compelling public interest outweighs the invasion of the 
individual’s privacy. The head of the institution is required to notify the Privacy 
Commissioner of such disclosures, in advance, unless the some urgency dictates 
otherwise. The Office reviews the proposed disclosures and, if deemed necessary, the 
Privacy Commissioner notifies the individual to whom the information relates. The 
Office also advises institutions when it believes the amount of personal information 
proposed for release is more than is needed to address the public interest and thus, 
we recommend measures to minimize the intrusion into the individual’s life. Issues 
surrounding this provision in the Privacy Act are discussed earlier in this report. 


We completed reviews of 66 such notices, a large number of them in two categories. 
The first category concerns individuals who were either unlawfully at large or being 
released from custody at the end of their sentences. All were considered at high risk 
to re-offend and therefore a danger to the community. We received 17 notices of this 
type, the majority of which came from the Royal Canadian Mounted Police and the 
Correctional Service Canada (CSC). 


The second significant group — 13 — came from the CSC, National Defence and 
the National Parole Board. They concerned the disclosure of personal information 
to family members of recently deceased individuals to provide them with the 
circumstances of death and with some modicum of closure. 


Another seven notices dealt with government accountability on matters such as the 
Ipperwash Inquiry with respect to the shooting of Dudley George, and the Board of 
Inquiry into the fire on HMCS Chicoutimi. 


Also of interest were six notices concerning health issues, including one from 
Public Safety and Emergency Preparedness Canada and one from the Department 
of Foreign Affairs and International Trade Canada (DFAIT) on health risks to the 
public from individuals with tuberculosis. 


There were also a variety of other notices, including one from the CSC regarding 


Karla Homolka, which provided information to her victims’ lawyer about her 
release. 
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Investigation Process under the Privacy Act 


Inquiry: 
Individual contacts OPC by letter, by telephone, or in person to complain of violation of the Act. Individuals who make contact in 
person or by telephone must subsequently submit their allegations in writing. 


4 


Initial analysis: 
Inquiries staff review the matter to determine whether it constitutes a complaint, i.e., whether the allegations could constitute a 
contravention of the Act. 


An individual may complain about any matter specified in section 29 of the Privacy Act — for example, denial of access, or 
unacceptable delay in providing access to his or her personal information held by an institution; improper collection, use or 
disclosure of personal information; or inaccuracies in personal information used or disclosed by an institution. 


v 
hana Complaint? Sees! 
No: Yes: 
The individual is advised, for example, that the matter is An investigator is assigned to the case. 


not in our jurisdiction. 


Investigation: 
The investigation provides the factual basis for the Commissioner to determine whether 
the individual's rights under the Privacy Act have been contravened. 


; Earlyresolution? | 
| Acomplaint may be resolved 
« before an investigation is 1 
undertaken if, for example, the 
a i : ; The investigator writes to the institution, outlining the substance of the complaint. The 
, issue has already been fully 3 ee, : : 

i ; investigator gathers the facts related to the complaint through representations from 

: : both parties and through independent inquiry, interviews of witnesses, and review of 

\ ! documentation. Through the Privacy Commissioner or her delegate, the investigator has 
i) 1 * : . : F : 

t hot contravene the Act the authority to receive evidence, enter premises where appropriate, and examine or 


Fe Oe ch Maer Sa Scr yk ad cate ‘ obtain copies of records found on any premises. 


dealt with in another complaint 
and the institution has ceased 
the practice or the practice does 


Discontinued? 
A complaint may be 
discontinued if, for 


: Analysis (on next page) 
: 
1 
example, a complainant 4 
; 
1 
1 
1 
1 


4-------------- 


decides not to pursue it, 
or a complainant cannot 
be located. 


Settled? (on next page) ------------------- 


Note: a broken line (- - - - ) indicates a possible outcome. 
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$$, 


Analysis: 
The investigator analyzes the facts and prepares recommendations to the Privacy Commissioner or her 
delegate. The investigator will contact the parties and review the facts gathered during the course of the 
investigation. The investigator will also tell the parties what he or she will be recommending, based on the 
facts, to the Privacy Commissioner or her delegate. At this point, the parties may make further representations. 


Analysis will include internal consultations with, for example, Legal Services or Research and Policy Branches, 


to take corrective measures to rectify the problem. 


as appropriate. 
pm 
Pree ee ee ew ew ee ewe ew ee ew ew ew ee ee ee ee 4 ; 
Sasa 3 1 ; 

' ' v 

a ee Findings: 

; : The Privacy Commissioner or her delegate reviews the file and assesses the report. The Privacy 
_--%_%__, Commissioner or her delegate, not the investigator, decides what the appropriate outcome should be and 
' Settled?! whether recommendations to the institution are warranted. 
| The OPCseeksto ! The Privacy Commissioner or her delegate sends letters of findings to the parties. The letters outline 
resolve complaints | the basis of the complaint, the relevant findings of fact, the analysis, and any recommendations to the 
1 and to prevent 1 _ institution. The Privacy Commissioner or her delegate may ask the institution to respond in writing, within 
| contraventions | aparticular timeframe, outlining its plans for implementing any recommendations. 

; fromrecurring. — | 

! Tectraiisne: : The possible findings are: 

' encourages 1 Not Well-Founded: The evidence, on balance, does not lead the Privacy Commissioner or her delegate to 
resolution through ; conclude that the complainant's rights under the Act have been contravened. 

i Negotiation and =} Well-Founded: The institution failed to respect a provision of the Act. 

| persuasion. The =! 

t investigator assists 1 Well-Founded, Resolved: The investigation substantiated the allegations and the institution has agreed 
t 1 


in this process. 
S Sut e ee ees + Resolved: The evidence gathered in the investigation supports the allegations raised in the complaint, but 
the institution agreed to take corrective measures to rectify the problem, to the satisfaction of this Office. 
The finding is used for those complaints in which Well-Founded would be too harsh to fit what essentially is 
a miscommunication or misunderstanding. 


In the letter of findings, the Privacy Commissioner or her delegate informs the complainant of his or her 
rights of recourse to the Federal Court on matters of denial of access to personal information. 


' Where recommendations have 
been made to an institution, OPC 
staff will follow up to verify that 


i] 
i] 
i 
t 
| they have been implemented. 


| The complainant or the Privacy Commissioner may choose to apply to the ; 
' Federal Court for a hearing of the denial of access. The Federal Court has the | 
' power to review the matter and determine whether the institution must 
provide the information to the requester. ; 


Note: a broken line (- - - - ) indicates a possible outcome. 
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Inquiries 


The Inquiries Unit responds to requests for information from the public about 
the application of the Privacy Act and PIPEDA. The Office receives thousands of 
inquiries each year from the public and organizations seeking advice on private 
sector privacy issues. 


In the 2005-06 fiscal year, the Office received 2,506 inquiries relating to the Privacy 
Act. This is somewhat less than the number of inquiries in the previous year, when 
we received 2,976 inquiries. In comparison, we received more than double the 
number of inquiries on issues relating to PIPEDA (see statistics in our 2005 Annual 
Report to Parliament on PIPEDA). 


The inquiries staff may be responding to fewer calls, but they are providing more 
information. A decision in 2004 to no longer accept e-mail inquiries has led to a 
refocusing of staff time on telephone inquiries, during which callers tend to seek 
longer and more in-depth explanations in response to their questions. In addition 
to this, an automated telephone system answers the public’s most frequently asked 
questions, such as those about identity theft, telemarketing and the Social Insurance 
Number. Our web site also provides a wide range of information. 


Approximately 25% of Privacy Act inquiries are answered in writing and 75% are 
answered by telephone. On average, written inquiries received a response within 
three months. The majority of telephone inquiries received an immediate response. 
The remainder, which may have required some research, received a response within 
three days. 


Inquiries Statistics 
April 1, 2005 to March 31, 2006 


Privacy Act Inquiries Received by the Inquiries Unit 


Telephone inquiries 1,929 
Written inquiries (letter, e-mail, fax) 577 
Total number of inquiries received 2,506 
Telephone inquiries 1,933 

Written inquiries (letter, e-mail, fax) 631 

Total number of inquiries closed 2,564 


AUDIT AND REVIEW 


agencies subject to the Privacy Act. It may also carry out audits of private 

sector organizations pursuant to section 18(1) of Canada’s Personal 
Information Protection and Electronic Documents Act (PIPEDA). The OPC also 
evaluates Privacy Impact Assessments (PIAs) prepared by federal departments and 
agencies. It also undertakes a variety of other projects relating to privacy practices in 
both the public and private sectors. 


T he OPC is responsible for carrying out audits of federal departments and 


The audit and review function of the Office serves its role as privacy guardian. 

The objective of this function is to conduct independent and objective audits and 
reviews of personal information management systems for the purpose of promoting 
compliance with applicable legislation, policies and standards and improving privacy 
practices and accountability. 


During fiscal year 2005-06, the Office completed one major audit pursuant to the 
Privacy Act, substantially completed three other audit projects and initiated a review 
of federal entities not subject to either the Privacy Act or PIPEDA. It also completed 
43 PIA reviews, as well as16 other projects. Staff also monitored the privacy-related 
activities of the Treasury Board Secretariat (TBS) and other federal departments and 
agencies. 


Stronger Privacy Management Framework Needed to Ensure Sound 
Privacy Management 


Last year the Office reported on the need for building a privacy management 
framework for the federal government. We outlined what a framework was, why 
it was important and described the features of a good privacy framework. We 
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also commented on some specific issues that needed to be addressed as part of 
strengthening privacy management in the federal government. 


The Treasury Board of Canada Secretariat (TBS) is responsible for setting privacy 
policy direction and providing guidance to federal institutions. Last year the OPC 
recommended that TBS develop a model framework to guide privacy management 
in federal departments and agencies. TBS management accepted this, indicating that 
it was committed to the concept and that it would examine the scope and process for 
a project. 


While the OPC is pleased to note good progress being made, all parties recognize 
there is considerable work yet to be completed. 


In December 2005, TBS informed us that officials have begun to examine 
preliminary concepts for the design and development of a privacy management 
framework to set out the government's privacy vision and strategy. The framework 
will provide the foundation for a comprehensive privacy risk management and 
accountability infrastructure to ensure the right balance between the privacy rights 
of Canadians and the requirements to fulfill other public interest goals and program 
mandates. An initiative was underway to consolidate and update various privacy 
policies relating to privacy impact assessments, data matching, data protection and 
use of the SIN — all areas of concern to the OPC. 


The OPC was consulted by TBS in developing a federal strategy to address concerns 
about the USA PATRIOT Act and Transborder Data Flows, mentioned earlier in this 
report. The government has responded well to the issue. In late March 2006, TBS 
published its strategy and issued guidance to federal government institutions for 
taking privacy into account before making contracting decisions. These documents 
are available on the TBS web site at www.tbs-sct.gc.ca. Among the activities reported 
as completed are the following: 


¢ The government made all of its 160 institutions subject to the federal 
Privacy Act aware of the privacy issues raised by the USA PATRIOT Act. 


¢ Institutions were asked to review their contracting and outsourcing 
arrangements to identify any risks under the USA PATRIOT Act, assess the 
seriousness of those risks, take corrective actions as needed, and report to 
TBS. It is reported that 83% classified their contracting as either “no risk” 
(77 institutions) or “low risk” (57 institutions). 
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° Best practices are promoted in outsourcing arrangements and a policy 
guidance document is available to federal institutions. It includes a privacy 
checklist, upfront advice on the importance of considering privacy prior to 
initiating contracts, ways of maximizing privacy protection and help in the 
development of clauses that can be included in requests for proposals and 
contracts. 


The federal strategy also indicates additional steps to further mitigate risk to privacy. 
Some are listed below, and they illustrate the considerable amount of work required 
in fully dealing with the issue. 


* Development of a privacy management framework to establish high 
standards for privacy protection throughout the federal government 

* Follow-up assessment of federal contracting activities and ongoing contract 
advice from TBS 

¢ Exploring technology and data architecture solutions to protect information 
flows, including the use of encryption technology and electronic audit trails 

¢ Development of additional guidelines to cover government-to-government 
information sharing (within Canada and abroad), auditing of contracts, and 
technical solutions to protect privacy 

* Increased awareness and training related to transborder data flows and 
existing federal safeguards 

¢ Ascheduled 2006 review of PIPEDA and the determination of whether the 
federal Privacy Act should also be reviewed (something the OPC strongly 
believes is long overdue) 

e Addressing privacy and transborder data flows for the recently announced 
Security and Prosperity Partnership (SPP) between Canada, Mexico and the 
LES: 

¢ Sharing of best practices in protecting transborder data flows with 
provincial and territorial governments, as well as the private sector and 
foreign governments 


We also applaud recent efforts by TBS to develop a privacy protection checklist 
—a set of principles and questions to guide government institutions in developing 
appropriate access to information and privacy clauses in contracts. 


When contracting out, the management of a government program or service must 


ensure the contract does not weaken the right of public access to information or 
significantly impact on their department's ability to protect personal information 


51 


ANNUAL Report TO PARLIAMENT 2005-2006 — Report ON THE Privacy AcT 


of individuals. This responsibility does not change when departments contract out 
services. An effective means to require that an outside service provider respects the 
requirements of the Privacy Act is to insert, when appropriate, relevant clauses in the 
contractual agreement. In this way, the contract helps ensure that the government 
institution’s responsibility for the protection of personal information continues to 
be fulfilled by the contractor. 


In March 2006 the OPC suggested that TBS pursue further enhancements to 
government contracting processes by considering the introduction of ways and 
means for businesses to report on their privacy management capabilities when 
seeking to become eligible to contract with the federal government. We see 
opportunity for further inculcating privacy management principles by incorporating 
privacy self assessment requirements into contracting arrangements with the federal 
government. This offers a powerful incentive to encourage businesses to comply with 
data protection principles as part of the social responsibility for doing business with 
the federal government. 


The significance of transborder data flow is underscored by our audit of the 

Canada Border Services Agency, also discussed in this chapter. This reminds us that 
protection of personal information is integral to the operations of departments and 
agencies, and is not just a matter for contracting out to third parties. The OPC urges 
better management, as well as greater accountability to Parliament and the Canadian 
public. 


The work of TBS on transborder data flow has advanced the building of a Privacy 
Management Framework. TBS indicates that such a framework would include best 
practices, sound risk management approaches and tools. The objective would be 

to ensure that federal institutions meet sound privacy management standards. We 
understand that TBS will establish an interdepartmental Privacy Committee that will 
collaborate on the continued development of the Privacy Management Framework. 


We will continue monitoring developments and will examine how departments and 
agencies are adapting new contracting guidance when carrying out audits of federal 
entities subject to the Privacy Act. 


Better Control and Accountability Required for Transborder Data Flow 


A major audit of the Canada Border Services Agency (CBSA) has now been 
completed. The following is a summary of the audit results. The full report can be 
found on the OPC’s web site at www.privcom.gc.ca. 
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Our audit of the CBSA and the review of public information about transborder data 
flow generally leads us to conclude that better control and accountability is required 
overall. Greater transparency should be given by government in order to allay public 
concern. 


The audit of the CBSA is important since Canadians are concerned about the flow of 
their personal information to the United States and about the possibility that it may 
be used for reasons unrelated to anti-terrorism or trans-national crime prevention 
objectives. The public, as well as Parliament, want to know whether the CBSA, which 
is the federal government agency most directly involved in maintaining border 
security, is sharing personal information with its foreign law enforcement and 
intelligence partners in a way that complies with privacy legislation and that protects 
the privacy rights of Canadians. 


Sound privacy management and accountability are essential in dealing with public 
concerns about the flow of personal information from Canada to other countries. 
Accordingly, the objective of the audit was to assess the extent to which the CBSA is 
adequately controlling and protecting Canadians’ personal information as it flows 
to foreign governments. The audit focused on specific CBSA program areas and 
systems associated with the its management of personal information relating to 
travellers. Lines of examination included: 


Customs enforcement and intelligence activities (land border and airports); 
Integrated Customs Enforcement System (ICES); 

Passenger Information System (PAXIS); and 

National Risk Assessment Centre (NRAC). 


ae Se 


The OPC also looked at the CBSA’s overall framework for managing privacy and 
how it reports publicly on its sharing of personal information with other countries. 


The approach and methodology included interviewing CBSA staff, examining 
documents (including records of trans-border sharing of personal information) and 
reviewing treaties, agreements, policies and practices which provide the framework 
for sharing this information between governments or their agencies. A special 
external advisory committee for the audit was formed to guide the work. 


The audit reports findings are effective as of November 2005, the date when the 
examination was substantially completed. 
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Our Key Findings 


The OPC found that the CBSA has policies, procedures and systems in place 

for managing and sharing personal information with other countries. However, 
much can be done to better manage the Agency’s privacy risks and achieve greater 
accountability and control over personal information that flows across Canada’s 
borders. Key findings are as follows. 


¢ While written requests for assistance from foreign governments seeking 
CBSA documents are processed in accordance with Agency requirements, 
much of the information shared between the CBSA and the United States 
at the regional level is verbal, and not based on written requests. This 
contravenes CBSA policy and the Canada-United States Customs Mutual 
Assistance Agreement (CMAA) of June 1984. 


¢ The CBSA needs a coordinated method of identifying and tracking all flows 
of its transborder data. The Agency cannot, with a reasonable degree of 
certainty, report either on the extent to which it shares personal information 
with the United States, or how much and how often it shares this 
information. By extension, it cannot be certain that all information-sharing 
activities are appropriately managed and that they comply with section 107 
of the Customs Act and section 8 of the Privacy Act. 


* Generally, the IT and management controls are sound for the Integrated 
Customs Enforcement System (ICES) and Passenger Information System 
(PAXIS). These systems contain sensitive personal information about 
millions of travellers. Notably, foreign jurisdictions did not have direct 
access to these systems. Secondly, electronic releases of information to the 
United States under the High Risk Travellers and Shared Lookout Initiatives 
of the CBSA are transmitted over secure communications channels. 
However, opportunities exist to strengthen the controls to further reduce the 
risk that personal information could be improperly used or disclosed. 


* The CBSA needs to explore ways to improve the quality and control of data 
it acquires under the Advance Passenger Information/Personal Name Record 
(API/PNR) initiative to ensure that personal information used for fulfilling 
the Agency’s customs mandate is as accurate and complete as possible. 


¢ The CBSA has not yet evaluated the effectiveness of the High Risk Travellers 
(HRTI) initiative with the United States because this project has not yet 
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been fully implemented. In particular, the Agency should assess the extent to 
which inaccurate or incomplete data may affect individuals or the Agency’s 
ability to identify, deter or apprehend “high-risk” travellers. An evaluation 
would help the Agency demonstrate that the HRTI initiative has achieved its 
enforcement and intelligence objectives and, accordingly, that its collection, 
use and sharing of vast amounts of personal information about millions of 
travellers are justified. 


¢ Since the CBSA is a new agency, the time is ripe for the Agency to build and 
integrate a comprehensive privacy-management framework into its day-to- 
day information handling practices. In particular, the Agency should work 
toward updating and strengthening the obligations contained in its personal 
information sharing agreements with the United States. The Agency should 
also consolidate its reporting of privacy incidents and look for ways to 
improve its mechanisms for monitoring cross-border disclosures of personal 
information to foreign law-enforcement agencies and other institutions. 


* Finally, the activities associated with sharing data across borders should 
be as transparent as possible. A clear and complete picture is not readily 
available with respect to what information is shared with whom, and for 
what purpose. As is the case for departments generally, the CBSA does not 
provide enough detail on the transborder flows of personal information, or 
account in a meaningful way for these flows to Parliament and the Canadian 
public. 


Our audit resulted in 19 recommendations to the CBSA, which are available in 
our full report. Within two years the OPC will follow up to assess the progress the 
Agency has made in implementing the recommendations. 


Importance of Privacy Impact Assessments 


The Office reviews the Privacy Impact Assessments (PIAs) and Preliminary Privacy 
Impact Assessments (PPIAs) prepared by government institutions for various 
projects, and we make recommendations on ways to reduce the privacy risks to 
Canadians’ personal information. 


Privacy Impact Assessment is a tool that helps ensure that privacy protection is a 
core consideration when a project is planned and as it is being implemented. PIAs 
are meant to describe and document what personal information is collected, how 
it is collected, used, transmitted and stored, how and why it can be shared, and 
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how it is protected from inappropriate disclosure at each step. In short, it is a risk 
mitigation tool. 


According to policy of the Treasury Board of Canada Secretariat (TBS), PIAs must 
be included in proposals for all new programs and services that raise privacy issues, 
and when existing programs are redesigned in a way that affects the collection, use 
or disclosure of personal information. This includes the conversion of government 
services for on-line use and delivery. 


The TBS policy, which came into effect in 2002, also requires federal government 
institutions to submit their PIAs and PPIAs to our Office for review. This allows 

the OPC to analyze the data flow and the steps taken to address potential privacy 
concerns. We check to make sure an authority is in place that allows the collection 
and use of Canadians’ personal information, and that the regulations and principles 
of the Privacy Act are being respected. We make comments to departments and 
agencies to identify potential problems that may have been overlooked and, as 
appropriate, we make recommendations for improving privacy protections. In some 
cases, we request that projects be considerably modified. 


The OPC believes the PIA policy has had a great impact on improving the overall 
awareness of privacy within government institutions. In our view, it has focused 
attention on potential privacy issues of a number of government programs. The 
whole process provides a greater level of protection for the personal information 
that Canadians give to the federal government. A well functioning PIA practice is key 
for a sound Privacy Management Framework. 


We are pleased to note that many of the PIAs we receive are becoming more precise 
and thorough in the years since the policy was first introduced. However, there is still 
considerable room for improvement. For example, the OPC has been encouraging 
departments to include in their submissions the action plans for implementing 
privacy protection strategies. 


This fiscal year the OPC looked at a wide range of projects undertaken by a number 
of departments, including Human Resources and Skills Development Canada 
(HRSDC), Health Canada, the Royal Canadian Mounted Police (RCMP), Transport 
Canada, Indian and Northern Affairs Canada, Citizenship and Immigration Canada, 
Revenue Canada, the Canada School of the Public Service, Social Development 
Canada, Veterans Affairs Canada, Public Works and Government Services Canada 
(PWGSC), Statistics Canada, the Canadian Air Transport Security Authority, the 
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Canada Border Services Agency (CBSA), National Defence, Farm Credit Canada and 
the Canada Firearms Centre. As varied as the responsibilities of these departments 
are, the projects share a common characteristic — they all collect, retain, share or 
disclose the personal information of Canadians. 


The following examples of PIAs offer an indication of the range and depth of the 
various projects we reviewed: 


¢ The RCMP Integrated Query Tool, a web application that brings together 
information from several discrete police information data bases into a 
central repository to allow a single search capability and a consolidated 
report on an individual 


¢ The RCMP Canadian Police Information Centre (CPIC) Renewal project 
and its sharing agreements with other jurisdictions 


¢ Asystem which allows Employment Insurance (EI) claimants to complete 
and submit their required reports online, using computers at home or in 
employment centres 


¢ APWGESC project to contract foreign banking services in order for 
Canadians living overseas to receive government payments, such as 
pensions, in a timely fashion 


¢ A Children’s Respiratory Health Study, surveying 25,000 elementary school 
children 


¢ A High Risk Traveller Identification Project in which the CBSA collects and 
shares with the United States information on individuals travelling by air to 
that country, and collects and analyses information on individuals arriving 
by air to Canada 


¢ A pre-boarding screening project involving remote video surveillance of 
passengers in airport boarding areas across the county by the Canada Air 
Transport Security Authority (CATSA) 


* An electronic health record project for the Canadian Armed Forces with 


the potential to contain the medical, dental and psychological health 
information for more than 80,000 Armed Forces personnel 
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* Citizenship & Immigration Canada’s use of biometrics (fingerprints and 
photos) in field trials at border crossings and as a method of cross-checking 
refugee claimants 


As illustrated above, the projects reviewed are diverse and in many cases require 
specific recommendations that pertain to the type of information collected and the 
type of systems being used. However, there are similarities in the types of privacy 
risks encountered, and general best practices for risk mitigation. 


For example, PIAs may only state in fairly general terms that accountability for 
protecting personal information “will be communicated” to staff, or that staff 
involved will be “made aware of” their responsibilities. The OPC prefers a much 
more specific and proactive approach, and has recommended the issuance of 
binding guidelines, protocols and well documented procedures. 


Similarly, PIAs submitted to us may not include a process for the departments or 
agencies to inform affected individuals if personal information has been found to be 
inappropriately disclosed either accidentally or as a result of theft. We recommend 
that every department have a clear policy in place to guide managers and other staff 
in instances where personal information has gone astray. 


Other examples of common recommendations to help mitigate privacy risks 
include: 


¢ Asking government institutions to ensure that privacy protections are built 
into contracts for processing or storing personal information, including 
regular departmental audits of contractors’ practices 


¢ Recommending the inclusion of clear acknowledgement of responsibility for 
safeguarding personal information in service agreements 


¢ Ensuring that PIA summaries are written in clear, non-technical language 
and that they are posted on departmental web sites 


¢ Reminding institutions of their obligation to amend personal information 


banks to reflect new information being collected, or new uses for that 
information, as required under the Privacy Act 
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¢ Training all staff in privacy protective work habits, and ensuring that all 
office procedures are compliant with the Privacy Act 


* Advising institutions to monitor the transaction logging programs that are 
in place to protect against unauthorized access to personal information 


As a particular issue, the OPC notes a trend of increased sharing of information 
among police and national security agencies for law enforcement and anti-terrorism 
purposes. Several of the PIAs reviewed could be grouped into these categories. 

A concern is that this Office receives privacy assessments of large and potentially 
privacy invasive projects in disjointed pieces, rather than as part of a comprehensive 
overview. The OPC has recommended to entities such as Transport Canada, the 
CBSA and the RCMP that an overall privacy management framework and/or a 
comprehensive PIA be developed at the outset of such large, integrated projects. 


The trend towards government institutions forming integrated networks to share 
personal information creates new privacy challenges. When several departments 
and agencies feed data into a network that is accessible to partners that span across 
jurisdictions, issues of governance, custody and control of information arise, as do 
issues around consent, right of access and correction. 


The OPC will continue monitoring some of the large-scale projects through 

PIA review and updates, including the expansion of the Canadian Public Safety 
Information Network (CPISN). This initiative, which falls under Public Safety and 
Emergency Preparedness Canada (PSEPC), seeks to establish a national information 
sharing network for Canada’s criminal justice system and law enforcement agencies, 
linking previously separated sources of data related to crime and offenders. The 
OPC will also monitor projects that collect and analyze the personal information 

of travelling individuals collected at border points and from passenger reservation 


| systems. 


_ As part of a privacy management framework, the OPC will continue encouraging 
_ departments to establish a formal administrative structure such as an internal 


committee or working group that is specifically responsible for reviewing 


| departmental initiatives to determine whether they require a PIA, and for 


implementing privacy risk reduction measures after a PIA has been done. The OPC is 
actively considering undertaking an audit of the government-wide PIA system in order 
to establish whether institutions are doing PIAs when they should, are following up on 


' risk assessment findings, and fixing privacy protection gaps when identified. 
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Other Work 


Following are other audit and review projects from the past fiscal year. 


Statistics Canada Census 

Statistics Canada has been consulting this Office regarding the 2006 Census for 

the past several years. One new dimension for the Census was a proposal to rely 
on services of a third party contractor. In response to concerns of this Office and 
others about initially proposed contracting arrangements with a company based in 
a foreign jurisdiction, Statistics Canada significantly revised its approach to ensure 
that no census data would reside outside of the department. 


Our monitoring of Census preparation included document review and a visit 

to the Data Processing Centre (DPC) of Statistics Canada. Based on this, we 

are satisfied that reasonable precautions are being taken to ensure the integrity 

and confidentiality of Census data. In addition to contract and policy means, 

these measures include independent IT security assessment of DPC, a threat risk 
assessment, and control of traffic in and out of the DPC. We did point out the need 
to amend documented procedures to clarify for the purpose of the 2006 Census that 
there should be no remote access to the DPC. 


Canada Post Track-a-Package 

In 2005 we investigated apparent vulnerabilities regarding Canada Post 
Corporation’s (CPC) web-based Track-a-Package service. As a result, CPC agreed to 
undertake several practice improvements. This included procedures to authenticate 
the identity of clients requesting information, means to inform customers that their 
signature will be available on the internet and ensuring that their signature does not 
appear for registered mail when a customer objects to this, and ways of reminding 
customers of the importance of protecting their PIN. 


Disclosure of certain personal information on CRTC web site 

In response to concerns communicated to our Office about the Canadian Radio- 
television and Telecommunications Commission (CRTC) publishing on its web site 
the personal contact information of interveners in public proceedings, we engaged 
with the CRTC in reaching reasonable solutions regarding notification and limiting 
access to such information. 
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Privacy Act Applications 
nce the Office of the Privacy Commissioner has investigated a complaint, 


IN THE COURTS 


6= 41 of the Privacy Act allows the individual to apply to the Federal 
Court for review of the government’s refusal to provide access to personal 
information. The following applications and appeals were filed in the past fiscal year. 
In keeping with our mandate, we have chosen not to reproduce the official style of 
cause of the cases in order to respect the privacy of the individual complainants. We 
are listing the court docket number and the name of the government institutions only. 


Président de l’Agence spatiale canadienne 
Federal Court File No.: T-1448-05 


Solicitor General of Canada 
Federal Court File No.: T-1724-05 


Minister of Public Safety and Emergency Preparedness 
Federal Court File No.: T-2123-05 


Royal Canadian Mounted Police 
Federal Court File No.: T-66-06 


Solicitor General of Canada 
Federal Court of Appeal File No.: A-111-05 
_ Minister of National Revenue 
Federal Court of Appeal File No.: A-270-05 


| 
| 
| 
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Section 42 of the Privacy Act also allows the Commissioner to appear in Federal 
Court. The Commissioner may ask the Court to review an institution’s refusal of 
access to personal information (with the complainant’s consent). She may act on 
behalf of individuals who have applied for review themselves, or with the leave of the 
Court, be a party to any review sought under section 41. No such situation arose in 
the past fiscal year. 


Judicial Review 


Complainants will sometimes seek judicial review under section 18.1 of the Federal 
Courts Act against the Privacy Commissioner. This occurred in the case described 
below, where the Commissioner was required to explain her jurisdiction to the 
Court when the complainant sought remedies that the Commissioner had no 
authority to grant. This case illustrates the seriously limited remedies available 
under the Privacy Act for any breaches other than improper denials of access. The 
Commissioner finds herself in the unenviable position of having to'demonstrate to 
the Court how she is unable to help the complainant. Clearly, this is an important 
issue for reform of the Privacy Act, which is discussed earlier in this report. 


Royal Canadian Mounted Police and Privacy Commissioner of Canada 
Federal Court File No.: T-1180-04 and Federal Court of Appeal File No.: A-183-05 


The applicant complained to the Privacy Commissioner, that among other wrongful 
conduct, the RCMP had breached the Privacy Act by disclosing his personal 
information to his employer without his consent. The Assistant Commissioner 
responsible for the Privacy Act agreed that his disclosure complaint was well- 
founded, but indicated that, unfortunately, no remedy exists for such disclosures 
under the Act. 


On June 18, 2004, the applicant sought a judicial review of the Assistant 
Commissioner’s report on his disclosure complaint. Although the Privacy Act 
restricts remedies to questions of access, he argued that the Privacy Commissioner 
must necessarily have the authority to fashion remedial orders and relief in cases 
(like his) where the Privacy Act has been contravened. 


In a decision dated March 29, 2005, the Court determined that the Privacy 


Commissioner had fulfilled her obligations under the Privacy Act and had correctly 
advised the applicant that the Privacy Act provides no remedy to address the 
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respondent's breach of his privacy. The applicant can obtain no further relief in the 
Court for the improper disclosure. 


_ The applicant appealed the Federal Court decision in April 2005, but discontinued 
the appeal a few weeks prior to the scheduled appeal hearing. 
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PUBLIC EDUCATION AND COMMUNICATIONS 


he Office of the Privacy Commissioner of Canada is mandated specifically 

under PIPEDA to educate the public and organizations on rules that govern 

the collection, use and disclosure of personal information in the course of 
commercial activities. Although there is no specified mandate for public education 
and communications under the Privacy Act, clearly it is necessary to communicate 
with government institutions about the application of the Act and the implications 
of their actions on the privacy rights of Canadians, so they can be held accountable 
for their personal information handling practices. There is also an expectation for 
the Commissioner and her Office to comment publicly on federal government 
initiatives involving personal information. 


_ Public Opinion Polling 


In 2004-2005, the Office developed a comprehensive communications and outreach 
_ strategy for the coming fiscal years. One of the initiatives in this strategy involved 


public opinion research, so that we could better understand how Canadians 
view privacy issues, as well as their levels of awareness. A majority of Canadians 


_ surveyed expressed a strong sense that their privacy and protection of their personal 


information was being eroded. Among other findings of particular interest, 
Canadians expressed concern about the transborder flow of personal information 
and expressed lower confidence in new technology, especially in the area of 
electronic health records. Respondents were also of the view that privacy laws should 
be updated to address the rapid evolution of information technology. This past 
fiscal year (2005-06), we conducted a follow-up study. The findings suggest that the 
concerns outlined above are still very present, and also that privacy laws must be 
updated to keep pace with leading-edge, transformational technologies that have a 
significant impact on privacy. A report on the latest study will be posted to our Web 
site in the summer of 2006. 
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Speeches and Special Events 


Speaking engagement opportunities have helped our Office promote privacy 

issues among diverse audiences and settings across Canada and abroad, including 

to professional and industry associations, non-profit and advocacy groups 

and universities. In the 2005-2006 fiscal year, the Commissioner, Assistant 
Commissioners and other senior officials delivered approximately 40 speeches. 

Our Office also continued to host an in-house Privacy Lecture Series approximately 
once a month. Privacy experts from Canada and abroad shared their observations on 
a wide range of issues with an internal and external audience of stakeholders. 


Media Relations 


Privacy issues continued to be of interest to the media in 2005-2006, with 

media coverage in Canada on issues such as government initiatives with privacy 
implications, privacy breaches, as well as surveillance technologies. These areas 
generated numerous media calls to and interviews with OPC officials. In addition, 
through other proactive media relations efforts, such as the dissemination of news 
releases, the Commissioner had an opportunity to share her views on federal 
government legislation and initiatives, such as the Passenger Project or the “No-Fly 
List”, and the Office’s views regarding transborder flows of personal information. 


Web Site 


The Office frequently posts new and useful information to its web site. Fact sheets, 
news releases, speeches, reports and publications, and case summaries of findings 
under the federal private sector law are posted to keep the site relevant to individuals 
and institutions. Since 2001-2002, we are pleased to report that visits to the site have 
more than quadrupled, and that we surpassed the one million visitors’ mark in the 
2005-2006 fiscal year. 


Publications 


Each year, the OPC produces and disseminates publications to individuals and 
organizations seeking information on privacy matters. These documents include 
annual reports, guides, as well as fact sheets and copies of both federal statutes. Not 
only were these materials sent to individuals upon request, they were also distributed 
at conferences and special events. Increasingly, individuals are also accessing these 
documents on our web site. 


66 


Pusiic EpucATION AND COMMUNICATIONS 


Internal Communications 


Internal communications activities were also a focus of the Office in 2005-2006, 
increasing transparency between management and staff, especially throughout the 
Office’s institutional renewal. Internal communications activities in 2005-2006 
involved providing information on issues such as human resources, upcoming 
speaking engagements, Parliamentary appearances, senior management and labour 
management committee meetings, and special events. In 2005-2006 the Office 

also launched its Intranet site which serves as the internal communications portal, 
maximizing staff access to information. 


Although public education and communications are an important part of our work, 
limited financial and human resources have constrained our ability to go much 
beyond simply responding to issues, rather than anticipating them and preparing 
public education strategies in advance. We have also discussed this in our recently 
tabled 2005 Annual Report to Parliament on PIPEDA. However, expected increases 
in funding will permit us to not only undertake the activities outlined above, but 

to undertake more extensive public awareness initiatives and to carry out the 
comprehensive proactive communications and outreach strategy mentioned earlier 
in this chapter. 
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CORPORATE SERVICES 


he Commissioner continues to focus on effective management renewal. 

During 2005-06, the main priority was the completion of the business 

case seeking long-term permanent resources. A second priority was 
strengthening our Human Resources management capacity. 


Planning and Reporting 


A foundation component of the Office’s institutional renewal is a strategic planning, 
reporting and control process. In 2005-06 we completed our second year under 
this revised process. The strategic plan established at the beginning of the year was 
our road map for the year. One important part of the new process was reporting 
and review opportunities. We reviewed and made adjustments to plans and 
_ budgets throughout the year. To assist in our reporting, we continued work on 
our Performance Measurement Framework and our monthly performance report 
has been in place for 18 months. This serves as a critical management tool for the 
_ evaluation of branch results against targets. 


Human Resources 


We continue to work toward the development and implementation of changes to 
improve how the Office is run and the overall quality of the workplace. Significant 
__ changes and improvements have been made to the Human Resource management 
policies and practices. 


We have implemented a number of Human Resource policies in consultation with 
central agencies and unions in line with the new Public Service Employment Act 
(PSEA) requirements. These policies will guide us as we build on the successes of the 
past year and as we continue on our path of institutional renewal. An Instrument 
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of Delegation of Human Resource Management was developed and will serve as 

a tool to inform and guide managers, and enable them to manage their human 
resources. A Strategic Human Resource Plan and a new Staffing Strategy, as well 

as an Employment Equity Action Plan, will help the OPC achieve its mandate 

and will ensure the recruitment of a highly qualified workforce that is diversified 
and representative of Canadian society. As part of the OPC’s commitment to 
increase transparency in the staffing processes, a staff newsletter was developed; it is 
distributed on a monthly basis to all staff. 


We made significant strides in the area of organizational learning, including the 
development of a learning strategy with the Canada School of Public Service (CSPS), 
training and information sessions in areas such values-based staffing, language, 
performance management, employee appraisals, and harassment awareness in the 
workplace. We have provided briefing sessions at our quarterly all-staff meetings, as 
well as to all managers on various aspects of the new PSMA and PSEA. The Learning 
Strategy and Curriculum with the CSPS enables staff to continue to develop the 
expertise and competencies required to fulfill their functions, which will position 
them to take on their new responsibilities and accountabilities. The learning 

strategy has been modified to reflect training requirements related to the new PSEA, 
including a Senior Management Committee Engagement Session and PSEA training 
for sub-delegated managers, both of which were offered in March 2006. 


We continue to work collaboratively with the Public Service Commission and the 
Public Service Human Resources Management Agency of Canada on follow-up 
measures to the recommendations of their audit reports. This includes measures that 
will allow OPC the opportunity to regain its full staffing delegation authority. 


Finance and Administration 


The OPC received a clean opinion on Audited 2004-2005 Financial Statements by 
the Office of the Auditor General of Canada. Combined with the 2003-2004 clean 
opinion, this is a very positive indicator that the organization has indeed advanced 
on the path of institutional renewal. The organization has built on that success by 
establishing planning and review cycles, and by streamlining and improving the 
financial management policies and practices of the OPC. 
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Information Management / Information Technology 


The IM/IT Division has accomplished many things over the past year. We have 
renewed our server infrastructure and increased data storage to allow for the 
scanning of documents. Good progress has been made on our Information 
Management project. Upgrades to our records management and correspondence 
tracking systems have been completed. Financial systems — Salary Management 
System (SMS) and FreeBalance - have been upgraded and the FreeBalance server 

has been upgraded as well. Five new tracking systems have been developed for the 
Audit and Review Branch to allow them to track their Audit files. We have completed 
the Action Plan for MITS Compliance and we are working steadily towards the 
December 2006 compliance deadline. 


Our Resource Needs 


As described in an earlier section of this report, the Office completed a thorough 
analysis that included a business process review of all OPC functions. Following 
that review we requested more than a fifty percent increase in resources which will 
bring our overall budget to approximately $18 million dollars and our full-time 
equivalents (FTEs) to a total of 140 over the course of the next two years. There will 
also be a shift in the relative distribution of resources to position the organization to 
be more proactive as opposed to reactive. 


Financial Information 


In past years the Annual Report was often produced later. This allowed us to provide 
financial tables relating to our expenditures at that time. The normal financial 
reporting cycle does not allow us to provide audited financial statements at the time 
of tabling this report. We will provide financial information in our Reports on Plans 
and Priorities, as well as our Departmental Performance Reports, both of which 

are tabled in Parliament. Furthermore, as we have in the past, we will also post to 
our web site the Audited Financial Statements for fiscal year 2005-06 once they are 
completed. For additional financial information, we encourage you to visit our web 
site at www.privcom.gc.ca. 
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APPENDIX 1 


Access and Privacy Complaints Closed by Institution and Finding 
From April 1, 2005 to March 31, 2006 


Not well- 
Respondent Discontinued | Resolution | founded 
0 


Bank of Canada 


Canada Border 
Services Agency 


Settled in Well- 
course of Well- founded 
founded | — Resolved 
0 


0 1 0 0 


1 0 4 1 1 


Canada Customs ; 
and Revenue 5 0 4 0 8 1 18 
Agency 0 


Canada Post 

Corporation “ : 4 : : g Pu 
Canada Revenue 

Agency 0 2 30 2 6 1 43 
Canadian Food 
Inspection 0 0 0 1 0 0 1 
Agency 0 

Canadian 


Human Rights 0 0 0 1 1 0 2 
Commission 0 


Canadian 
Nuclear Safety 0 0 1 0 0 0 1 
Commission 0 


Canadian 


Security 51 
Intelligence : : 4 ® : : : 


Service 


Canadian Space 
Agency 


Citizenship and 
Immigration 6 0 7 0 10 ] 3 27 
Canada 
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Access and Privacy Complaints Closed by Institution and Finding (cont.) 
From April 1, 2005 to March 31, 2006 


Settled in Well- 

course of founded 
Respondent — Resolved 
Correctional 
Investigator : y : ° : 2 
Correctional 
Sarvice Canada 27 11 40 5 22 14 3 120 
Farm Credit 
Canada 0 0 1 0 0 0 0 1 
Fisheries and 
Oceans 1 0 3 0 1 0 0 5 
Foreign 
Affairs and 
International 0 0 2 0 0 0 | 3 
Trade Canada 
Health Canada 0 0 2 0 4 0 0 6 
Human 
Resources 
and Skills 0 3 5 0 9 1 2 20 
Development 
Canada 
Immigration 
and Refugee 0 0 8 0 1 0 1 10 
Board 
Indian and 
Northern Affairs 0 0 2 0 0 0 0 2 
Canada 
Industry Canada 0 0 1 0 0 0 0 1 
Justice Canada, 
Department of 0 g M 0 3 0 2 16 
Library and 
Archives Canada 0 0 0 0 3 0 0 3 
Military Police 
Complaints 0 0 1 0 0 0 0 1 
Commission 
National Capital 
Commission Y uy 0 0 ‘ 0 0 4 
National 
Defence 1 0 1 2 3 2 1 10 
National Gallery 
ni Canad 1 0 0 0 0 0 0 1 
National Parole 0 0 1 0 2 1 0 4 


Board 
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APPENDIX 1 


Access and Privacy Complaints Closed by Institution and Finding (cont.) 
From April 1, 2005 to March 31, 2006 


Settled in Well- 
Not well- course of Well- | founded 
Respondent | Discontinued | Resolution | founded | Resolved | investigation | founded | — Resolved | Total 


National 
Research Council 0 0 0 0 1 0 2 3 
Canada 


Natural Sciences 

and Engineering 

Research Council 0 0 0 
of Canada 


Office of the 
Commissioner 
of Official 
Languages 


Office of the 
Chief Electoral 0 0 10 0 1 0 0 11 
Officer 


Pacific Pilotage 
Authority 0 0 0 0 0 0 1 1 
Canada 


Pension Appeals 0 
Board Canada 


Privy Council 

Office 0 0 1 0 0 0 0 1 
Public Service 

Commission 0 0 0 0 | 3 0 4 
Canada 


Public Works 
and Government 0 0 1 1 0 0 0 2 
Services Canada 


Royal Canadian 
Mounted Police 5 0 36 4 12 1 1 59 


Social 
Development 1 0 3 0 4 0 0 8 
Canada 


Statistics 
Canada 


Transport 0 1 
Gonads 0 1 0 0 0 0 


Treasury Board 1 2 
Secretariat ; : ] : : 


Veterans Affairs 0 0 2 
Canada : e : : : 


Total 92 17 218 15 110 28 23 503 
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APPENDIX 2 


Time Limit Complaints Closed by Institution and Finding 
From April 1, 2005 to March 31, 2006 


Settled in 
Not well- course of 


Respondent | Discontinued | Resolution | founded | Resolved | investigation | Well-founded 


Canada Border 0 0 


Services Agency 0 0 0 in "1 


Canada Post 
Corporation 


Canada Revenue 4 
Agency 


Canadian Air 

Transport 0 
Security 

Authority 


Canadian Food 
Inspection ] 0 0 0 0 0 1 
Agency 


Canadian 
Security 
Intelligence 
Service 


Citizenship and 
Immigration 2 0 1 0 0 55 58 
Canada 


Correctional 
Service Canada 


Environment 1 1 
Eanada 0 0 0 0 0 


Export 
Development 0 1 0 0 0 0 1 
Corporation 
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Time Limit Complaints Closed by Institution and Finding (cont.) 
From April 1, 2005 to March 31, 2006 


Settled in 

Not well- course of 
Respondent founded | Resolved | investigation | Well-founded Total 
Foreign 
Affairs and 
International ® 0 6 0 | 20 2] 
Trade Canada 
Health Canada 0 0 0 0 0 9 9 
Human 
Resources 
and Skills 0 0 2 0 0 1) 4 
Development 
Canada 
Immigration 
and Refugee 15 0 6 0 4 98 123 
Board 
Industry Canada 0 1 0 0 0 0 1 
Justice Canada 1 0 2 0 0 6 9 
Library and 
Archives Canada 2 0 0 0 a | 1 
National 
Archives of 0 0 0 0 0 1 1 
Canada 
National 
Darence 4 0 1 0 0 18 23 
National Gallery 
of Canada 0 | 0 0 0 0 { 
National 
Research Council 0 0 23 0 0 23 46 
Canada 
Privy Council 
Office 0 0 0 0 0 2 2 
Public Service 
Commission 0 0 2 0 0 0 2 
Canada 
Public Works ; 
and Government 0 0 1 0 0 1 2 
Services Canada 
Royal Canadian 
Mounted Police ’ 0 1 u 2 83 1 
Transport 
Cahoda 0 2 0 0 0 0 2 
Total 49 6 59 11 8 404 537 
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MESSAGE FROM THE COMMISSIONER 


The doors of the Office of the Privacy Commissioner of Canada opened for business 
25 years ago. 


Canada’s first Privacy Commissioner, John Grace, summarized the deep significance of 
his new mandate to protect the privacy of Canadians in his first annual report: 


Societies which treat privacy with contempt and use personal information as a cheap 
commodity will sooner or later hold the same attitudes towards their citizens. Privacy, 
therefore, is not simply a precious and often irreplaceable human resource; respect for 
privacy 1s the acknowledgement of respect for human dignity and of the individuality 
of man. 


The source for a concern with privacy is an innate respect for personhood. Privacy is 
the ultimate minority protection. That is why the claim of privacy is so much more 
than a cry to be left alone or a fashionable obsession. 


A quarter-century later, those eloquent words remain as true as ever. Privacy continues 
to be a deeply held value. However, it is also an increasingly fragile value. 


Even that first annual report observed “it has become trite to say that personal privacy 
is threatened as never before in human history.... The confluence of new technologies 
with ever-insistent claims of the state to know, to be efficient, or both, has changed the 
quantitative and qualitative nature of the problem.” 


Since then, the power of computers has multiplied many times over. 


So too have governments’ appetites for personal information about their citizens. In 
Canada and elsewhere, the rationale of safety and national security has been used to 
justify a dramatic expansion in the amount of personal information governments collect, 
analyze and share about us. 
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The potent combination of state interest in personal information and technological 
advances making it possible to gather and exploit this data on a massive scale is a theme 
highlighted — once again — in this 2007-2008 annual report on Canada’s public sector 
privacy law. (Our work related to private sector organizations is described in our annual 
reports on the Personal Information Protection and Electronic Documents Act, or PIPEDA.) 


New Threats to a Fragile Value 


This year, for example, our Office, along with our provincial and territorial counterparts, 
sounded the alarm about Canada’s Passenger Protect program — also known as the 
no-fly list — and the secretive use of personal information to determine who may and 
may not board aircrafts. The program raises profound concerns about privacy and other 
rights, such as mobility, access to information and due process — yet we have seen no 
evidence demonstrating the effectiveness of no-fly lists. 


We also pointed out potential privacy and security risks related to the development of 
enhanced driver’s licences as an alternative to the Canadian passport. 


Our Office, along with our counterparts in every other provincial and territorial office 
responsible for privacy protection, have concerns about the personal information of 
participating drivers leaving Canada and the potential that RFID chips in the licences 
could permit surreptitious location tracking. We also have concerns about our inability, 
in practice, to oversee how U.S. authorities receive and use this information. 


Both the no-fly list and enhanced driver’s licences are well-intentioned initiatives — one 
is aimed at preventing terrorist incidents on planes; the other at providing Canadians 
with an alternative form of identification for crossing the Canada-U.S. border. 


We are nof arguing that the government has any malicious or intrusive intentions, even 
as it develops programs that result in increased surveillance of Canadians. 


However, there needs to be a greater acknowledgement of the fact that our privacy 
rights are fragile in the face of government. They falter each time we trade away the 
personal and private for promises of more safety, greater efficiency or faster service. 


There must also be a wider recognition of the reality that with each well-intentioned 
promise comes an increased erosion of privacy, risk of data security, diminished 
intellectual freedom and less personal autonomy. 


The Orwellian dystopia was predicated on a totalitarian society. In our democracy, 
benevolent intentions appear to be pushing us toward a surveillance society. 
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Building Respect for Privacy Rights 


Privacy, like any other freedom, is not an absolute right. It is conditional, limited by 
other rights we have recognized in our laws. And it is contextual — other laws may 
override it. There may be some cases where privacy protections must give way to protect 
a greater good, be it public health, consumer safety or national security. 


However, we should on/y be asked to make this sacrifice when it is clear that the 
promised outcome — such as safer air travel — will actually be achieved and that there is 
no other less privacy-invasive option that would allow us to reach the goal. 


The state must consider: Is there really a need that clearly outweighs the loss of privacy? 
Is the proposed measure likely to be effective in achieving the intended purpose? Is the 
intrusion on privacy proportional to the benefit to be gained? Is there some other less 
privacy-invasive way to achieve the same goal? 


Unfortunately, recent federal initiatives are not always meeting this privacy test. 


Technological advancements continue with no sign that governments recognize that 
amassing and analyzing mountains of personal data — virtually all of it from perfectly - 
ordinary people — may not be the most effective way to protect us. 


The threats to privacy have grown dramatically since the Office of the Privacy 
Commissioner opened its doors — with ever-growing databases, network computing, 
consumer profiling, and national security concerns. The list of issues has been daunting. 


I can only imagine the challenges that a Privacy Commissioner will face a mere 15 years 
into the future with ubiquitous computing, handheld devices, nanotechnologies and 
more powerful surveillance techniques. 


Despite challenges, our efforts to protect | can only imagine the 
privacy in the public sector are not as effective challenges that a Privacy 
as they could be given that the privacy law ee ; 
governing federal government programs is Commissioner will face 


desperately outdated. a mere 15 years into the 
future with ubiquitous 
computing, handheld 
devices, nanotechnologies 
and more powerful 
surveillance techniques. 
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Privacy Act Reform 
The Privacy Act needs to be overhauled. 


Our hopes for better privacy protection for Canadians were revived in the spring of 
2008, when the House of Commons Standing Committee on Access to Information, 
Privacy and Ethics announced a review of the Privacy Act. 


Following this, our strategy was to provide the Committee with proposals that have 

a realistic chance of being adopted relatively soon. We put forward ten “quick fixes” — 
simple, straightforward suggestions for improving the legislation. Experts from across 
Canada, including members of our External Advisory Committee, testified in support of 
the needed reform. 


The changes would go some way to improving privacy protections, but in no way 
eliminate the need for a highly detailed review and complete overhaul. 


We look forward to seeing the Committee’s recommendations. Hopefully there will be 
some good news to report on legislative reforms in our next annual report. 


Privacy Red Flags 


‘The importance of strong protections for personal information held by governments 
— and the potential risk to citizens if such safeguards are not in place — was vividly 
demonstrated with a huge data breach in the United Kingdom in late 2007. 


An administrative error — sending two unencrypted computer disks through an internal 
government mail system — compromised the personal information of 25 million people. 


Strong privacy legislation can help prevent these sorts of simple but catastrophic 
mistakes, which leave people at serious risk for identity theft or other harms. 


In this annual report, we focus on similarly ; ant P 
dramatic shortcomings in how some federal Strong privacy legislation 
institutions here in Canada are handling the can help prevent these 
personal information of the citizens they were sorts of simple but 
established to serve. 


catastrophic mistakes, 
Audits conducted by our Office uncovered which leave people at 
serious problems with the privacy practices serious risk for identity 
of three organizations that hold a great deal theft or other harms. 


of highly sensitive personal information — the 
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Royal Canadian Mounted Police (RCMP), Passport Canada, and the Department of 
Foreign Affairs and International Trade (DFAIT). 


RCMP Audit 


The privacy issues we discovered while conducting an audit of the RCMP’s exempt data 
banks — designed to prevent public access to the most sensitive national security and 
criminal intelligence files — were significant enough to prompt us to use our powers to 
table a special report to Parliament for the first time in the history of my Office. 


The audit found that tens of thousands of files sheltered in RCMP exempt data banks 
should not have been there — raising questions about government transparency and 
accountability. Canadians should be able to see their personal information unless the 
disclosure could threaten national security, international affairs or lawful investigations. 


The repercussions of such poor information management are potentially grave. People 
named in an exempt bank file could face serious harms. 


Passport Audit 


With this annual report, we are releasing the findings of an audit which identified 
serious flaws in privacy practices and procedures related to Canada’s passport operations. 


‘The audit uncovered a worrying series of problems in the way in which personal 
information is handled by Passport Canada and DFAIT. These problems may put at risk 
the privacy of Canadians applying for passports. 


Training for Public Servants 


One of the issues identified in our passport audit was the fact that some of the 
employees handling applications did not have a clear understanding of their obligation 
to protect privacy. 


Training is essential to ensure all public servants understand their important 
responsibilities under both the Privacy Act and related Treasury Board Secretariat 
guidelines. Privacy training must be a requirement for public servants who handle 
significant amounts of personal information. 
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International Efforts 


Given the speed at 
Our Office is ae — by necessity — looking which our personal data 
beyond Canada’s borders to develop privacy 3 
solutions for Canadians. Zips around the globe, 
assuring Canadians’ 
Transborder data flows and the Internet have privacy requires strong 
transformed privacy into a global issue. Given : } 
the speed at which our personal data zips international approaches 
around the globe, assuring Canadians’ privacy to data protection. 
requires strong international approaches to 
data protection. 


Privacy protection can no longer be done on a country by country basis. The only way to 
succeed is by working collectively on privacy and security issues. 


Canada is well-positioned to contribute to this effort. Over the years, we've developed 
a flexible, collaborative approach to data protection in the global context. Traditional 
close ties to the United States and membership in both the Asia Pacific Economic 
Cooperation (APEC) and the Organisation for Economic Cooperation and 
Development (OECD) place Canada in an excellent strategic position to help facilitate 
cooperation between countries. 


I’ve been honoured to be able to work with the OECD Working Party on Information 
Security and Privacy. This group’s work is key to ensuring that global flows of 
information are adequately protected. The OECD Recommendation on Cross-border 
Privacy Co-operation adopted last year was a positive step, but we still have a ways to go. 


We have also participated in the work of APEC, which is now implementing the APEC 


Privacy Framework. 


In September, we hosted privacy advocates and experts from around the world at the 
29th International Conference of Data Protection and Privacy Commissioners in 
Montreal, following a 2002 commitment. This conference was an important opportunity 
to discuss global privacy concerns and solutions. Commissioners resolved to increase 
cooperation and to help develop universally accepted international privacy standards in 
the area of information technology. 


We will continue our work to encourage the development of global standards which will 
benefit people around the world. 
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Farewell to an Assistant Commissioner 


Finally, on a more personal note, my Office is bidding aw revoir to Raymond D’Aoust, 
Assistant Privacy Commissioner responsible for the Privacy Act. 


Raymond arrived at the OPC at a very challenging time in the Office’s history. A 
Commissioner and a handful of senior officials had just resigned amid a very public 


scandal. 


Raymond brought the ideal personal attributes to help rebuild morale and resolve an 
organizational crisis — kindness, sensitivity and a passion for people. He encouraged 
a balanced approach to work and life — even introducing lunchtime yoga in the office 
boardroom. 


A long career of committed public service provided Raymond with extensive experience 
in areas such as program evaluation, review, public consultation, strategic planning, 
business planning and quality management. He used all of this knowledge to make a 
major contribution to institutional renewal at the OPC. 


Gifted with remarkable analytical skills, Raymond was consistently brilliant at 
identifying all the components of a given situation so he could assess it fairly and 
properly. A man of principle and a consummate professional, his tireless efforts and 
effective, firm diplomacy were instrumental to his many successes. 


Raymond also brought with him a deep commitment to protecting privacy rights. His 
efforts have been driven by a strong notion of what the work of this Office means for 
individual Canadians. He was front and centre on a number of key files, including the 
protection of DNA, electronic health records, enhanced driver’s licences and the no-fly 
list — to name but a few. I must also congratulate him for his stalwart endeavours to 
push Privacy Act reforms forward. He successfully conducted a number of governmental 
policy studies and helped found the Association of Francophone Data Protection 
Authorities. 


The Office of the Privacy Commissioner has greatly benefited from his work and we are 
pleased that he will continue to work with us as Special Advisor to the Commissioners 


until his retirement. 


Un tres grand merci Raymond. 
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A Strong Team 


I would also like to thank the rest of the wonderful team in my Office for their 
dedicated service over 2007-2008. As this annual report illustrates, the issues we work 
on each day are varied, complex and challenging. We've been lucky enough to attract an 
exceptionally talented new generation of privacy protection experts to our ranks over the 
past year. 


I offer a special word of thanks to everyone working so hard on our initiatives related 
to Privacy Act reform, international data protection and investigation re-engineering 
— all of which are critical to ensuring our Office will be a strong, effective guardian of 
Canadians’ privacy rights well into the future. 


Jennifer Stoddart 


Privacy Commissioner of Canada 


KEY ACCOMPLISHMENTS IN 2007-2008 


Our Office serves three key client groups — Parliament, federal government departments 
and agencies, and individual Canadians — under the Privacy Act. 


Some of our key accomplishments in 2007-2008 include: 


Proactively Supporting Parliament 


Tabled the Privacy Commissioner’s first special report to Parliament, which 
outlined the findings of an audit of the RCMP’s exempt data banks 


Prepared a submission and appeared before the Commission of Inquiry into the 
Investigation of the Bombing of Air India Flight 182 


Appeared six times before parliamentary committees on such issues as identity 
theft and the Canada Elections Act 


Worked with the Standing Committee on Access to Information, Privacy and 
Ethics on the statutory review of PIPEDA; responded to Industry Canada’s 
consultation on PIPEDA review 


Joined provincial and territorial privacy oversight officials in passing joint 
resolutions on the privacy risks associated with enhanced driver’s licences, as 
well as the need for comprehensive changes to the no-fly list program 


Serving Canadians 


Responded to 4,258 Privacy Act-related inquiries and 2,367 general inquiries 
Investigated hundreds of privacy complaints in the public and private sectors 


Created a blog to help stimulate a discussion with Canadians on privacy issues 


ANNUAL ReporT 10 ParuiameNT 2007-2008 — Report oN THE Privacy Act 
Began work on a social marketing campaign aimed at encouraging awareness 
and prompting action on children’s privacy online 


Participated in court cases in order to help develop privacy-conscious 
jurisprudence in Canada 


Supporting Federal Government Institutions 


e 


Reviewed government policies and initiatives as they relate to privacy legislation 
and provided input to federal institutions, as well as Parliamentarians 


Reviewed 93 Privacy Impact Assessments 


International Highlights 


Hosted the 29th International Conference of Data Protection and Privacy 
Commissioners, honouring a 2002 commitment 


Joined other international data protection authorities in passing resolutions 

on the need for global standards for safeguarding passenger data; greater 
international cooperation on privacy issues; and active involvement in the 
development of universally accepted international privacy standards in the area 
of information technology 


Chaired an OECD group working to enhance cooperation between data 
protection authorities and other privacy rights enforcement agencies around 
the world; the OECD adopted a recommendation on cross-border cooperation 
based on the volunteer group’s work 


Contributed to an APEC data privacy group’s efforts to implement a new 
privacy framework for APEC members 


Worked with the Standards Council of Canada on the development of 
international privacy standards 


Joined the International Standards Organization (ISO) and became a member 
of an important ISO Working Group tasked with developing and maintaining 
standards and guidelines addressing security aspects of identity management, 
biometrics and the protection of personal data 


Participated in the International Working Group on Data Protection in 
Telecommunications, which has recently focused on Internet privacy 
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Key AccomPLisHMeNts IN 2007-2008 
e Played a lead role in the creation of an international association of data 
protection authorities and other enforcement agencies from francophone states 
e Became a member of the Asia Pacific Privacy Authorities Forum 
Encouraging Research and Debate 
e Commissioned 22 research projects related to emerging privacy issues 


e Issued a consultation paper seeking feedback on the implications of using 


RFID technology in the workplace 


e Published a discussion paper on the role of identity in society and the privacy 
issues related to identity 
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PRIVACY BY THE NUMBERS IN 2007-2008 


Average number of Privacy Act inquiries per month: 


Average number of new Privacy Act complaints received per month: 


Average number of investigations closed per month: 
Total investigations closed during the year: 
Privacy Impact Assessments reviewed: 
Privacy Impact Assessments closed: 
Parliamentary appearances: 

Bills/acts reviewed for privacy implications: 
Research papers issued: 

Public events organized: 

Formal visits by external privacy stakeholders: 
Research activities commissioned: 

Speeches and presentations delivered: 

Media requests: 

Interviews provided: 

News releases issued: 


Average hits to our website per month: 


Average hits to our blog per month (September 2007 to March 2008): 


Litigation decisions under Privacy Act: 
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PASSPORT CANADA AUDIT: 
SIGNIFICANT RISK FOR PRIVACY 


Lack of adequate safeguards leaves the personal information of passport 
applicants vulnerable to misuse 


Privacy and security problems in Canada’s passport operations add up to a significant 


risk for Canadians applying for passports, an OPC audit has found. 


‘The audit at Passport Canada and the Department of Foreign Affairs and International 
Trade (DFAIT) unfortunately found weaknesses in every step of the application process; 
the way in which personal information is collected and stored; how it can be accessed; 
and how it is ultimately disposed. 


For example, passport applications and supporting documents were kept in clear plastic 
bags on open shelves; documents containing personal information were sometimes 
tossed into regular garbage and recycling bins without being shredded — and some 
documents that had been shredded by a private contractor could easily be put back 
together. Meanwhile, computer systems allowed too many employees to access certain 
passport files and controls, such as audit logs and encryption, were missing. 


‘These privacy and security shortfalls are particularly worrying given the high sensitivity 

of the personal information involved in processing passport applications. There is a 

risk that this information could be used for 

nefarious purposes if it wound up in the These privacy and security 

wrong hands. F 
shortfalls are particularly 

We are pleased that Passport Canada and worrying given the high 

DFAIT have indicated they will take action sensitivity of the personal 


on our recommendations. : ee . 
information involved 


in processing passport 
applications. 
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Background 


Passport Canada processed more than 3.6 million passport applications in 2006-2007. It 
currently has more than 30 million passport records under its control. The information 
people provide on their application forms, supporting documentation, as well as 
passports include highly sensitive personal information. 


Passport Canada is an agency of DFAIT, which has a mandate to issue passports. It also 
provides guidance to DFAIT missions issuing passports abroad. 


Missions issued approximately 136,000 passports in the 2006-2007 fiscal year. While 
that represents only 3.5 per cent of the total number issued, DFAIT has acknowledged 
that the delivery of passport services abroad is “exposed to a high degree of inherent 
risk.” 


There is a risk of consequences — identity theft, for example — to individual passport 
holders if their personal information goes missing or is stolen. It’s clear that stronger 
safeguards are required to protect this data. 


Unfortunately, while the passport agency has adopted some good privacy and security 
features, the audit identified shortcomings. There are a number of opportunities to 
strengthen the privacy management framework and practices for the passport program. 


Privacy Management Framework 


Passport Canada does not have a Chief Privacy Officer. In fact, DFAIT has not 
delegated full authority to Passport Canada for privacy matters. As a result, key privacy 
responsibilities for the passport program are dispersed and, in our opinion, have not 
been given sufficient attention. 


While the appointment of a Chief Privacy Officer is not a legislated requirement, 
it is increasingly becoming a practice among federal departments and agencies with 
significant personal information holdings. 


The appointment of a Chief Privacy Officer helps ensure that privacy issues have a 


champion at the corporate decision-making table. It also ensures accountability for an 
organization's privacy management practices. 


16 


Passport CANADA Aupit: SiGNIFICANT Risk FOR PRIVACY 


Collection Issues 


Our Office’s list of other concerns begins with the passport application itself. Passport 
Canada concentrates a large amount of sensitive personal information on one 
application form. Credit card information is collected along with other identifying 
information, such as names, addresses, phone numbers, birthdates and sometimes Social 
Insurance Numbers. 


Financial information and other personal information — particularly a Social Insurance 
Number — are key information ingredients sought by identity thieves. 


Because an applicant’s credit card information is combined with other application 
form information (both physically and electronically), virtually any employee involved 
in the passport process can access credit card numbers — even if they don't need this 
information to process the application. 


Too Much Access 


Too many DFAIT employees are able to see completed passport documents and the 
personal information they contain. 


Access to personal information on passport applications is not adequately controlled to 
ensure that only employees who require this information can see it. 


For example, consular officials at missions around the world — including locally hired 
staff — had computer access to passport files processed by any other mission abroad even 
though the need to access this information was infrequent and the information could be 
provided by other means on a need to know basis. As a further example, mission staff in 
one city can access completed passport records from other cities — and vice versa. 


Our audit found a case where a former mission employee still had access to the passport 
management system even though she had left that employment six months earlier. One 
employee responsible for protocol and official visits had full access rights to the system — 
though it had nothing to do with his job. Other employees were included on the access 
list, although they no longer had access to passport records. 


Passport Canada has been raising the security level it requires for employees handling 
passports to the “Secret” level. However, many consular employees, including most 
locally hired staff, still only have a basic “reliability” security level. In many countries 
around the world, difficulties in obtaining criminal and intelligence records pose a 
challenge for raising the security level of locally hired, non-Canadian staff. 
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DFAIT could mitigate the inherent risk 

associated with locally hired staff by using The lack of such an audit 
better access controls and also keeping track ; : ih he 
of who is accessing passport files. trail flags a privacy risk in 
Canada's passport system 
We were surprised to find that IT systems that — if left unchecked — 
for completed passport application files at 
both pate cae and DEAIT lacked a could lead to undetected 
computer safeguard to track who had viewed security risks and data 


these records. breaches. 


The lack of such an audit trail flags a privacy 
risk in Canada’s passport system that — if left unchecked — could lead to undetected 
security risks and data breaches. 


Security Shortfalls 


In some passport offices and missions abroad, passport records and supporting 
documents were stored in clear plastic bags and left on open shelves on their premises. 


Use of portable memory devices, and the lack of encryption for stored personal 
information, and the transmission of e-mails with passport information outside DFAIT 
and Passport Canada, all pose a further risk to the protection of personal information. 


Neither Passport Canada nor DFAIT has an organization-wide policy restricting 
employees’ use of portable memory devices such as memory sticks and cell phones at 
work. Such devices are small, easy to use and hold large quantities of data. Anyone 
with access to passport information systems could photograph or download and copy 
personal information onto a portable device without being detected. 


While our audit was not designed to detect privacy breaches, and none came to our 
attention during the audit (other than a breach of the Passport On-Line system), 

it is clear that a great deal of trust is placed in the employees who process passport 
applications, including locally employed staff. While we recognize the need for trust is 
inherent in the process, enhanced controls support trust and mitigate risk. 


We also found that Passport Canada archives electronic passport records for up to 100 


years — even though the reasons for keeping this personal information for such a long 
period of time are unclear. 
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PassPorT CANADA Aupit: SIGNIFICANT Risk FOR Privacy 


‘The risk that this personal information will be compromised is heightened by the fact that 
personal information stored on both Passport Canada’s main database and DFAIT’s passport 
system is not encrypted. Another information technology concern is that e-mails containing 
personal information sent outside of secure internal networks may not be protected by 
encryption and are, therefore, vulnerable to interception and improper use by hackers. Many 
employees we interviewed were unaware that such e-mails may not be protected. 


Our Office also has a number of concerns about the way in which Passport Canada is 
disposing paper and electronic passport records. 


A number of Passport Canada offices and Canadian missions abroad disposed of 
passport administration forms containing personal information, such as names and dates 


of birth, in ordinary garbage and recycling bins. 


At one private-sector shredding facility under contract with Service Canada, we found 
that — even after the documents had apparently been shredded — entire passport photos 
remained intact and documents could be pieced together with little effort. 


Finally, the design of consular areas in some missions does not offer adequate privacy for 
clients. Applicants’ sensitive conversations with consular officials can be overheard by 
other people in public waiting areas. 


Online Risks 


While our audit was underway, the OPC learned through the media about a breach 

of Passport Canada’s online passport system. An Ontario man using the system had 
discovered he could access other applicants’ sensitive passport information by randomly 
changing one number in the Uniform Resource Locator, or URL, which appears at the 
top of each page on every Internet site. 


Passport Canada shut down the system and corrected the programming problem. 


The agency told us that the incident was the only breach of this type it was aware of. 
Given that the man who had seen other people’s personal information had immediately 
reported the breach to Passport Canada, the risk to Canadian’s passport information was 
considered minimal by the agency. Passport Canada is investigating further and we are 
awaiting a full report. 


Passport Canada has plans to replace the online system within a year with a new method 
to encrypt and protect personal data. 
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Recommendations and Next Steps 


Our Office provided Passport Canada and Foreign Affairs with 15 recommendations to 
strengthen the privacy management framework for passport operations. 


These include: 

e Hiring a Chief Privacy Officer at Passport Canada 

e Providing ongoing privacy and security training programs to staff 

e Introducing better controls on access to passport information 

e Reassessing the current 100-year retention period for passport information 

e Providing essential safeguards, including: more restricted access to areas where 
passports are processed; privacy for clients discussing passport applications; re- 
evaluating adequacy of security screening for employees; policies on portable 
memory and recording devices, such as cell phones; and expanded use of 


encryption 


Further to our audit report, both Passport Canada and DFAIT have agreed with most 
of our recommendations. 


We will follow up with Passport Canada and DFAIT on our recommendations with a 
post-audit. 


We would like to thank Passport Canada and DFAIT employees for their 


professionalism, cooperation and responsiveness during our audit. 


The full audit report, including management responses, is available on the OPC website. 
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ADMINISTRATIVE AND QUASI-JUDICIAL BODIES: 
BALANCING OPENNESS AND PRIVACY IN THE INTERNET AGE 


Complaints to the OPC highlight concerns about federal administrative and 
quasi-judicial tribunals posting highly sensitive personal information to the web 


Highly personal information about Canadians fighting for government benefits and 
taking part in other federal administrative and quasi-judicial proceedings is being posted 
to the Internet — exposing those people to enormous privacy risks. 


In 2007-2008, the OPC investigated 23 complaints regarding the disclosure of personal 
information on the Internet by seven bodies created by Parliament to adjudicate 
disputes. (We received three more similar complaints in May 2008.) 


These administrative and quasi-judicial bodies consider issues such as the denial of 
pension and employment insurance benefits; compliance with employment and other 
professional standards; allegations of regulatory violations; and irregularities in federal 


public service hiring processes. 


The adjudication process often involves very intimate details related to people’s lives, 
including their financial status, health, job performance and personal history. 


Few would question the fundamental importance of transparency in tribunal proceedings. 


But is it in the public interest to make 


considerable amounts of an individual’s Why should a law-abiding 
sensitive personal information citizen fighting for a 
indiscriminately available to anyone with an government benefit be 
Internet connection? 

forced to expose the 
Why should a law-abiding citizen fighting for —_ intimate details of her 
a government benefit be forced to expose the personal life to public 
intimate details of her personal life to public a 
Be ay? scrutiny? 
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The Human Impact 


“Anybody, anywhere in 
The decisions of administrative and quasi- 


judicial decision-makers are routinely packed Me whole world, who 
with personal details that not many people types my name comes 
would be comfortable sharing widely: immediately to this 


salaries, physical and mental health problems personal information... 
as well as detailed descriptions of disputes ae 
with bosses and alleged wrongdoing in the this situation leaves me 
workplace. open to criticism and 

mockery.” 
In addition to the types of personal 
information legitimately needed in these 
bodies’ reasons for decision, seemingly irrelevant information is often included — the 
names of participants’ children; home addresses; people’s place and date of birth; and 
descriptions of criminal convictions for which a pardon has been granted, for example. 


Many complainants told us they were distressed to discover — typically with no prior 
notice — that this type of information about them was available on the Internet for 
neighbours, colleagues and prospective employees to peruse. 


The following are some of the comments we heard: 


“By posting my name, I feel violated in my privacy and this could adversely affect my prospects 


for jobs, business and my image in the community. I have never given consent.” 


‘Anybody, anywhere in the whole world, who types my name comes immediately to this 
personal information... this situation leaves me open to criticism and mockery.” 


‘I'm at a loss to understand why this would have been done, except to think that this is further 
punitive measures taken against me.” 


‘The potential for embarrassment, humiliation and public ridicule is significant. A long- 
ago legal transgression or temporary lapse in judgment could continue to haunt an 
individual for many, many years into the future. 


Individuals whose personal information, particularly financial information, is disclosed 
on the Internet may be at greater risk of identity theft. They also face a risk of 
discrimination, harassment and stalking. The information could also be used by data 
brokers that compile profiles of individuals. 
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ADMINISTRATIVE AND QUASI-JUDICIAL BODIES: BALANCING OPENNESS AND PRIVACY IN THE INTERNET AGE 


A list of the bodies whose practice of posting personal information online have 
resulted in complaints investigated by the OPC in 2007-2008: 


Canada Appeals Office on Occupational Health and Safety 


The Canada Appeals Office on Occupational Health and Safety (CAO), now known as the Occupational Health and Safety Tribunal 
Canada, is a quasi-judicial administrative tribunal that determines appeals of decisions and directions issued by health and safety 
officers. It operates under the auspices of Human Resources Development Canada. Decisions rendered by this tribunal may include 
an individual's name, coupled with that person’s personal opinions or views and place of employment. 


Military Police Complaints Commission 


The Military Police Complaints Commission is an independent federal body that oversees and reviews complaints about the conduct 
of Military Police members. The Commission is empowered to: review the Provost Marshal's handling of complaints concerning 

the conduct of Military Police; deal with complaints alleging interference in military police investigations; and conduct its own 
investigations or hearings related to complaints when the Commission believes that doing so is in the public interest. 


All of the Military Police Complaints Commission decisions are vetted by the Commission with a view to the standards expressed in 
the Privacy Act. Most decisions rendered by the Military Police Complaints Commission are published on the Internet in summary 
and depersonalized form. Where decisions are not depersonalized, they may contain extensive personal information about military 
police members. 


Pension Appeals Board 


The Pensions Appeal Board is responsible for hearing appeals flowing from decisions of the Canada Pension Plan Review Tribunals. 
A hearing before the board may be initiated by an individual seeking Canada Pension Plan (CPP) benefits or by the Minister of Social 
Development. The board has the authority to determine, among other things, whether benefits under the CPP are payable to an 
individual. 


Board decisions reveal a considerable amount of sensitive personal information about individuals seeking benefits, including dates 
of birth, detailed family, education and employment histories, extensive personal health information and personal financial data. 


Public Service Commission 


The Public Service Commission is a quasi-judicial tribunal that may conduct investigations and audits on any matter within its 
jurisdiction, including safeguarding the integrity of appointments and in overseeing the political impartiality of the federal public 
service. Its decisions may include information relating to individuals’ education or medical or employment history. 


Public Service Staff Relations Board 


The board, which has been replaced by the Public Service Labour Relations Board, was a federal tribunal responsible for 
administering the collective bargaining and grievance adjudication systems in the federal public service. 


Decisions may include descriptions of individuals’ conduct and issues at work as well as disciplinary sanctions they've faced. 
RCMP Adjudication Board 


An RCMP Adjudication Board conducts formal disciplinary hearings respecting RCMP members’ compliance with the Code of Conduct 
adopted under the Royal Canadian Mounted Police Act. Decisions include information about alleged misconduct, and, in some cases, 
other personal information such as an officer's marital situation and medical information. Adjudication Board decisions, which 
include the names of individuals, are published on the RCMP intranet, although the Board has advised that it intends to post its 
decisions on the Internet. 


Umpire Benefits Decisions (Service Canada) 


The Employment Insurance Act permits claimants and other interested parties to appeal to an umpire certain decisions rendered 
under that Act. An umpire is empowered to decide any question of fact or law that is necessary for the disposition of an appeal. 


Decisions by an umpire tend to reveal detailed information about the employment history of claimants. A typical decision might also 
reveal information about a claimant's place of residence, marital status and sources of income. 
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Access to Justice 


Another concern we have is that access to justice could suffer if tribunals, boards and 
other administrative decision makers continue to post decisions on the Internet. 


‘The risk of having one’s personal details made public may make people increasingly 
reticent to assert their rights in administrative and quasi-judicial proceedings. People 
trying to obtain benefits required to provide food and shelter for themselves and their 
families may feel that participation in tribunal proceedings is essentially mandatory — 
and that they have no option other than to give up their right to privacy. 


In some cases, however, individuals have declined to exercise their legal right to appeal 
administrative decisions that significantly impacted them because of the loss of privacy 
this would entail. 


“Open Court” Principle 


‘The widespread practice of posting reasons for decisions on the Internet appears to be 
based on the assumption by decision makers that the rules — or lack of rules — which apply 
to judicial proceedings apply equally to administrative and quasi-judicial proceedings. 


Many of the institutions investigated argued that the “open court” principle required the 
online publication of decisions. 


‘The open court principle is an important part of our legal system and exists to ensure the 
effectiveness of the evidentiary process, encourage fair and transparent decision-making, 
promote the integrity of the justice system and inform the public about its operation. 
Opening decision-making processes up to public scrutiny assists to further these goals. 


However, there is an important distinction between the courts and the institutions 
we investigated. The Privacy Act, which does not apply to the courts, applies to many 
administrative tribunals and quasi-judicial bodies and imposes specific rules on them 
regarding the disclosure of personal information. Through the Privacy Act, Parliament 
may be said to have set express limits on the extent to which the open court principle 
could authorize publication of decisions of the administrative tribunals subject to its 
provisions via the Internet. 


Striking a Reasonable Balance 
Respect for the open court principle can co-exist effectively with government 


institutions’ statutory obligations under the Privacy Act through reasonable efforts to 
depersonalize any decisions posted online by replacing names with random initials. 
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It is beyond debate that the public requires access to the information necessary 

to maintain confidence in the integrity of a tribunal’s proceedings, to enhance the 
evidentiary process, to promote accountability and to further public education. Yet in 
most cases, these important goals may be accomplished without disclosing the name of 
an individual appearing before a tribunal. 


The identity of individuals appearing before tribunals is not obviously relevant to the 
merits of any given tribunal decision. As the open court principle is intended to subject 
government institutions to public scrutiny, and not the lives of the individuals who 
appear before them, the OPC has taken the position that the public interest in accessing 
information about tribunals’ proceedings does not obviously or necessarily extend to 
accessing identifying information about individual participants. 


Furthering the values that the open court principle promotes will not be hindered if, 
consistent with government institutions’ obligations under the Privacy Act, only de- 
personalized decisions that do not reveal the identities of participants are made available 
to the public. It is, of course, also open to tribunals to redact all personal information 
that would otherwise be found in reasons for decision made available to the public. 
However, simple suppression of direct and obvious identifiers such as names is likely 

to represent the most efficient and effective means of complying with the Privacy Act. 
This method of protecting privacy poses no significant threat to tribunals’ independence 
and ensures that the facts and issues in individual cases may be fully and transparently 
debated in an open and accessible manner. 


Where there is a genuine and compelling public interest in disclosure of identifying 
information that clearly outweighs the resulting invasion of privacy, institutions have the 
legal authority to exercise their discretion to disclose personal information in identifiable 
form in their decisions. For example, where the public has a compelling interest 

in knowing the identity of an individual who has been found guilty in disciplinary 
proceedings, or of someone who poses a potential danger to the public, a tribunal may 
exercise its discretion to disclose personal information, including that individual’s name, 


to the public. 


Likewise, where Parliament or a body empowered to make regulations has drafted a 
law or regulation that authorizes the disclosure of personal information, the Privacy 
Act permits disclosure of personal information in accordance with such a provision. In 
this way, the Act recognizes the right of lawmakers to craft disclosure regimes that are 
responsive to particular tribunals’ mandates and the associated demands of the open 
court principle. 


There is, thus, no intractable conflict between the rights and interests protected by the 
open court principle and compliance with the Privacy Act. 
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It is also noteworthy that courts, too, are increasingly recognizing the need to limit the 
disclosure of personal information in judgments. The Canadian Judicial Council has 
published a Recommended Protocol for the use of personal information in judgements. 
This protocol recognizes it can be appropriate for judges to omit some personal 
information from a judgment in the interests of protecting privacy. Where appropriate, 
these guidelines encourage the judiciary to omit from judgments personal data 
identifiers, highly specific personal information and extraneous personal information 
with little or no relevance to the conclusions reached. 


Privacy Act Limits 


During our investigation, we found there is a significant lack of consensus among 
administrative and quasi-judicial decision-makers on the limits that the Privacy Act 
places on the Internet disclosure of personal information in their decisions. 


The decisions of most, if not all, institutions subject to the Privacy Act contain personal 
information to which the protections of the legislation apply. 


The Privacy Act says that personal information under the control of a government 
institution may be disclosed for the purpose for which it was obtained or compiled, or 
for a use consistent with that purpose. 


The OPC concluded that the blanket electronic disclosure of these bodies’ reasons for 
decision on the intranet or Internet is not the purpose for which the information was 
obtained. Rather, tribunals collect personal information for the purpose of making a 
decision on the facts of each specific case before them. 


Moreover, disclosing administrative or quasi- 


judicial decisions with identifiable personal a disclosing 
information on the Internet as a matter administrative or quasi- 
of course was not found to be reasonably judicial decisions with 
necessary for the accomplishment of the identifiabl 
investigated institutions’ mandates. It was ldentinabie persona 
not a disclosure for a use that was consistent information on the 
with the purpose for which the personal Internet as a matter of 
information was obtained — particularly 

course was not found to 


when the uses to which sensitive personal 
information would be put could not be be reasonably necessary 
identified in advance or controlled in any way. for the accomplishment 


Under the Privacy Act, limits on the # uy ns 
disclosure of personal information do not institutions’ mandates. 
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apply to publicly available information. Some of the institutions investigated argued that 
the publicly accessible nature of administrative and quasi-judicial proceedings rendered 
the personal information discussed during those proceedings publicly available for the 
purposes of the Act. 


However, none of those institutions presented any evidence to indicate there was 
any record, in any form, of the personal information disclosed during the course of 
proceedings that is available in the public domain. Our Office found that disclosure 
of personal information during a proceeding did not in itself render that information 
available in the public domain. 


The Privacy Act also allows for disclosure of personal information in accordance with 
any Act of Parliament or regulation authorizing such a disclosure. 


Some institutions argued that the disclosure of personal information was permissible 
due to the fact that relevant legislation or regulations did not prohibit or address 
disclosure. We rejected this argument. There must be some specific indication in an Act 
or regulation that Parliament intended to permit disclosures of personal information 
outside of the quasi-constitutional regime created by the Privacy Act. Legislative silence 
on the issue does not constitute a legal authority to disclose personal information. 


Recommendations 


In the well-founded complaints we investigated, our Office made a number of 
recommendations to government institutions: 


* Reasonably depersonalize future decisions that will be posted on the Internet 
through the use of randomly assigned initials in place of individuals’ names; or post 
only a summary of the decision with no identifying personal information. 


* Observe suggested guidelines respecting the exercise of discretion to disclose 
personal information in any case where an institution proposes to disclose personal 
information in decisions in electronic form on the Internet. 


* Remove decisions that form the basis of the complaints to the OPC from the 
Internet on a priority basis until they can be reasonably depersonalized through the 
use of randomly assigned initials and re-posted in compliance with the Privacy Act. 


- Restrict the indexing by name of past decisions by global search engines through the 
use of an appropriate “web robot exclusion protocol;” or remove from or reasonably 
depersonalize all past decisions on the Internet through the use of randomly 
assigned initials, within a reasonable amount of time. 
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Response to OPC Concerns 


Even after being advised of privacy issues, most government institutions were reticent to 
change their policies and practices. 


Notwithstanding the growing number and severity of privacy threats to individuals 
whose personal information is posted indiscriminately on the Internet, some 
government institutions told us they plan to continue posting sensitive personal 
information as they always have. 


Others took important but incomplete steps towards improved compliance with the 
Privacy Act. As a result of our investigations, some institutions have implemented 
technical measures to prevent the names of individuals who participate in their decision- 
making processes from creating “search hits” when typed into major search engines. 
Others have agreed to use initials in place of individuals’ names. 


Notably, Service Canada and Human Resources Development Canada agreed to fully 
implement our recommendations. 


The OPC has relayed the results of its investigation to the complainants. In cases where 
these results were disappointing, the OPC remains committed to working with the 
bodies involved with a view to improving privacy protections for those who participate 
in administrative and quasi-judicial processes. 


The varying degrees of responsiveness to the OPC’s recommendations means that, even 
among those institutions investigated, there remains inconsistent privacy protection for 
Canadians who participate in these institutions’ administrative and/or quasi-judicial 
proceedings. 


It is also worth noting that many other administrative and quasi-judicial bodies post 
online reasons for decisions that link identifiable individuals with a great deal of 
sensitive personal information, but the OPC has not received complaints about them. 


Next Steps 


Under the Privacy Act, this is not a matter that we are empowered to bring before the 
courts for further guidance. 


However, our Office is committed to continuing to work with the government 
institutions which have been reluctant to implement all of the recommendations. We 
hope that by maintaining a constructive dialogue, we will be able to persuade these 
organizations to take the steps necessary to protect Canadians’ privacy. 
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We also see a need for a new government- 
wide policy on this privacy issue. Given We hope that by 

the complexity of the issues involved, ae 
recommendations flowing from our maintaining a 
investigation of a small number of institutions constructive dialogue, we 
are not the best instruments around which will be able to persuade 
to build government-wide compliance with 


the Privacy Act. A comprehensive policy these organizations to 

document based on consultations with a take the steps necessary 

wider range of government institutions is to protect Canadians’ 
ired. ; 

require privacy, 


We have already conveyed to the Treasury 

Board Secretariat our view that centralized policy guidance is required. This guidance 
will ensure consistency in the privacy protection available to Canadians who participate 
in administrative and quasi-judicial proceedings. 


Many institutions we investigated agreed with our view that centralized policy 
guidance is required and would welcome the same. They were willing to participate in 
consultations with Treasury Board to develop policy guidance and comply with this 
guidance when it took effect. 


Treasury Board has advised our Office that its officials continue to work on developing 
guidance for federal institutions subject to the Privacy Act with respect to the posting of 
personal information on government websites. Treasury Board has also indicated that it 
will consult with our Office on any draft guidance that is developed. 


Electronically publishing personal information contained in the administrative and 
quasi-judicial decisions of government institutions is risky privacy business. We look 
forward to working with Treasury Board on this important issue to ensure Canadians’ 
privacy will be better protected by strong policy guidance in the future. 


The trend to put more and more federal government information online raises important 
questions about how to balance the public interest and individual privacy rights. 


While the use of the Internet to promote transparency and accountability in the 
federal government — posting contracts and travel expenses, for example — is a welcome 
development, it is clear there must be limits when it comes to the disclosure of personal 
information. 
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Providing ail employees who handle personal information with privacy training 
is one of the key ways in which governments can prevent data breaches 


In late 2007, a relatively simple mistake by a British civil servant led to one of the 
biggest data breaches in history. 


‘The incident compromised the personal information of 25 million people receiving 

a child benefit — and stands as a cautionary tale for governments around the world 
about the need to take data protection, including employee privacy training, extremely 
seriously. 


An official in the U.K.’s Revenue and Customs Office had placed two computer disks 
containing details about families registered in a child benefit database into an envelope 
to be couriered to another government department. 


The CDs did not arrive at their destination and have yet to be recovered. 


The breach, which exposed families across Britain to the risk of identity theft, resulted in 
the resignation of the chairman of the Revenue and Customs Office and led to a major 
police investigation. 


After its investigation, the British Independent Police Complaints Commission 
concluded that individual staff members were not to blame. Instead, it said “woefully 
inadequate” data handling practices and procedures, including a lack of training for staff, 


led to the breach. 


“There was: a complete lack of any meaningful systems; a lack of understanding of the 
importance of data handling; and a ‘muddle through’ ethos,” the Commission said. “Staff 
found themselves working on a day-to-day basis without adequate support, training or 
guidance about how to handle sensitive personal data appropriately.” 
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Following the breach, the British government 
introduced mandatory annual training for all Privacy training should 
civil servants who deal with personal data. 


be mandatory for all 
Here in Canada, the OPC has for some managers and all public 
time been urging the federal government to servants who handle 


provide better training for public servants 
on the fundamental principles of personal 
information management. This privacy 
training should be mandatory for all managers and all public servants who handle 
personal information. 


personal information. 


Unless adequate learning programs are put in place, a regrettable incident could lead to 
a breach of personal data held by a federal department or agency. Such a breach could 


affect thousands — if not millions — of Canadians. 


Over the last few years, we have seen a number of significant breaches of personal 
information occurring all over the world, in both private and public sector organizations. 


These breaches often take the form of the inadvertent or negligent loss of personal data 
by employees or the theft of equipment containing such data. In many of these cases, the 
breaches could have been avoided if employees handling the personal information had 
received training on the fundamental principles of secure and responsible information 
management. 


Audit Concerns 


Recent OPC audits underscored the need for comprehensive privacy training for employees 
who handle personal information in federal government departments and agencies. 


In October 2007, our Office published the results of an audit assessing the effectiveness 
and outcome of Privacy Impact Assessments (PIAs) conducted by federal government 
departments and agencies for new or redesigned programs and services. 


One of the audit’s principal conclusions was that more training is needed to ensure that 
program managers understand their responsibilities under the Treasury Board Policy 
on Privacy Impact Assessments, and have the privacy knowledge and skills necessary to 
conduct effective PIAs. 


While some government institutions have made a serious effort to apply the policy, the 


audit found more is required to ensure PIAs are having the desired effect — namely to 
establish and enshrine privacy protection as a core consideration in government program 


34 


PRIVACY TRAINING IN THE FEDERAL PuLic SERVICE: THE NeED FOR A COMPREHENSIVE APPROACH 


and service delivery. The audit also discovered an uneven application of the policy, 
including a number of performance failures. Our auditors attributed these disappointing 
results to many causes, including a lack of training. 


Another major audit, described in detail in our 2005-2006 annual report, examined the 
management practices of the Canada Border Services Agency (CBSA) with regards to 
trans-border data flows and found similar challenges with regards to training needs of 

key personnel. 


Generally, the audit identified significant opportunities for the CBSA to better manage 
privacy risks and achieve greater accountability, transparency and control over the trans- 
border flow of personal information. 


The audit called for providing regular and ongoing training sessions on the 
administration of, and compliance with, the Privacy Act. It recommended designing and 
implementing a privacy management framework for the CBSA, a component of which 
would be the creation of a committee of senior managers mandated with ensuring that 
privacy guidance and training are provided. 


Finally, the audit recommended the development of specific training modules to combat 
problems with verbal exchanges of personal information between Canadian and U.S. 


border officials. 


An audit of Canada’s passport operations, detailed earlier in this report, also highlighted 
how a lack of adequate training can lead to privacy and security risks. 


A Core Curriculum 


Some federal government departments and agencies have recognized the need for better 
privacy training for employees. Statistics Canada and Citizenship and Immigration have 
introduced training regimes and formal instruction to raise awareness of privacy issues 
and legislation. The Treasury Board Secretariat has also been providing training for some 
years to the ATIP community. In addition, the Secretariat provides ongoing advice to 
individual institutions - both ATIP and program officials - on specific privacy-related 
issues. 


Despite these success stories, on the whole we feel the federal government could be 
doing much more. 


Part of the problem lies in the fact that there is no mandatory core curriculum for 


educating public servants who process or manage personal information about their basic 
duties and responsibilities under the Privacy Act. 
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Nor is there a mandatory core curriculum for training these employees on widely 
recognized privacy fair information principles, which govern the appropriate collection, 
use, disclosure, and disposal of personal information within government. 


The Canada School of Public Service offers two training modules on privacy and access 
laws. However, these are not mandatory. (The two current courses will be merged into 
one new course beginning in early 2009.) 


Many departments and agencies have designed their own training programs, but in most 
cases this training is insufficient. 


The Public Service Commission of Canada (PSC), for example, runs information 
sessions to provide advice and training to its managers about the impact of the Privacy 
Act on various programs. The sessions are so popular that the PSC turned some of its 
managers away in 2007 for lack of resources to provide training. The PSC has since 
expanded the program in an attempt to meet the demand. 


The Department of Foreign Affairs and International Trade has built a permanent 
policy, process, and training regimen to ensure that all access to information and privacy 
analysts receive the training they need to do their jobs. However, the department is of 
the view that there is a pressing need for more widespread training. 


Clearly, some departments are willing to meet that need with proactive programs that 
formalize privacy training. What they need is additional training support to get the job 
done. 


A Comprehensive Approach 


The OPC is of the view that a coordinated and comprehensive strategy needs to be 
developed and implemented by key players in the federal government: the Canada 
School of Public Service (CSPS); Treasury Board Secretariat (TBS); and ATIP offices 


in every federal government department and agency. 
The Role of the Canada School of Public Service 


The Canada School of Public Service’s key mandate is to ensure all public service employees 
have the knowledge and skills they need to develop policy and deliver services for Canadians. 


We believe that the School should develop a core, mandatory privacy training curriculum 
to be used by all government departments and agencies in training employees who handle 
significant amounts of personal information. The target audience for the core curriculum 
should be employees up to and including supervisors. Teaching modules and a trainers’ 
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guide should be developed in consultation with the key government institutions in Ottawa 
that handle significant amounts of personal information. 


The School should also develop a distinct mandatory training module for all middle- 
and senior-level government managers, acquainting them with the fundamentals of 
privacy and personal information management. This module could be integrated into 
existing courses for managers, or offered as stand alone courses, as required. (While the 
School currently offers two training modules on privacy and access laws, these are not 
mandatory and their target audience consists of functional specialists and supervisors as 
well as managers.) 


Development of the core curriculum, teaching module and trainers’ guide should be 
done in consultation with the Offices of the Privacy Commissioner and the Information 
Commissioner. 


The Role of ATIP Units 


We believe that individual ATIP units should play the lead role in dispensing privacy 


training to employees and supervisors within their respective departments and agencies. 


‘The foundation of the training provided would be the core curriculum and trainers’ 
guide developed by the CSPS, described above. We recognize, however, that training 
needs may vary from one department or agency to another. Indeed, federal government 
institutions that handle large amounts of personal data—such as the Canada 

Revenue Agency or the Canada Border Services Agency—will have different training 
requirements than a department that handles comparatively little personal information, 
such as the Department of Finance. That is why we believe that departments and 
agencies should be free to adapt the core curriculum and trainers’ guide to their 
particular needs and situations. 


Treasury Board Secretariat’s Role 


TBS is responsible for government-wide administration of the Privacy Act. The 
Secretariat coordinates the administration of the Act by preparing and distributing 
policies and guidelines to help institutions interpret the law and to assist them in their 
application on high profile issues. 


We believe TBS should make mandatory the training we have described above 
throughout the federal public service. Indeed, TBS needs to continue to play a 
leadership role in promoting and overseeing privacy training and awareness across the 
entire federal public service. Its role and importance in ensuring a culture of privacy 
within the public service cannot be understated. 
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The Creation of “Privacy Training Champions” 


Every department and agency should consider appointing a “privacy training champion” 
whose mandate would be to oversee and promote privacy training and learning across 
that institution. This individual should be a member of the senior management team, 
possibly the organization's chief privacy officer. 


In keeping with the recommendation the OPC made in its audit of the Canada Border 
Services Agency, every government institution should consider creating a committee of 
managers mandated with ensuring that requisite guidance and training are provided to 
programs areas on privacy issues. 


Training Content 


‘The key objective of a privacy training program should be to provide public servants 
with grounding in federal government requirements respecting the protection of 
personal information holdings, and the knowledge of best practices for managing 
personal information. 


In order to accomplish this, a privacy training program for public servants would need to 
address certain key themes and subject matters: 


e Knowledge of Statutory and Policy Requirements: Public servants must 
understand their duties and responsibilities under the Privacy Act, attendant 
regulations, and other statutory instruments germane to privacy. (Individual 
departments and agencies may also need to tailor their training programs to take 
into account special requirements under the legislation they administer, as well as 
internal policies respecting data management.) 


e Knowledge of What Constitutes Personal Information: Public servants who 
manage personal information need a solid grounding in the definition of personal 
information — recorded information about an identifiable individual — and what this 
can include. 


e Knowledge of Basic Principles: Federal public servants need to know what 
personal information they can collect, use and disclose in the course of their duties. 
And they need to know how to maintain personal information in a secure manner. 
Knowledge of the basic principles of privacy — often referred to as “fair information 
principles” — is essential. 


e Knowledge of Best Practices: Some techniques, methods and processes are better 
than others at delivering positive privacy promotion and protection outcomes. 
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Providing public servants with a strong knowledge of these techniques will help 
ensure the personal information of Canadians held by government institutions is 
managed with limited problems or unforeseen complications. Best practices from 
federal government institutions, as well as those from other jurisdictions — the 
provinces, foreign governments and the private sector — should be built into the 
training program. 


Conclusion 


Public serv 
‘The federal government needs to address ants who 


the privacy training and learning needs of manage the personal 
its employees head on. And it needs to do information of Canadians 
so immediately, before a regrettable incident are stewards of a public 


similar to the one in the U.K. occurs. é 

trust that underpins our 
Public servants who manage the personal system of government. 
information of Canadians are stewards of 
a public trust that underpins our system of 
government. 


Public servants require sound knowledge of the laws, rules, regulations and policies 
governing privacy and the management of personal information in the federal 
government. They need a firm understanding of what constitutes personal information; 
the basic principles of privacy protection and fair information practices; and an 
appreciation of the best practices for managing personal information. 


This specialized knowledge can only be acquired through a comprehensive and 
coordinated training program for all federal public servants who manage personal 
information. The Treasury Board Secretariat and the Canada School of Public Service 
have a leadership role to play in this regard. ATIP units within individual government 
departments and agencies also have a key role to play, as they are best placed to dispense 
the knowledge that staff in their institutions require. 


The OPC remains ready to help all of these key players with the development of a 


privacy training curriculum for the federal government. 


A comprehensive approach to privacy training and learning is one of the key elements 
required to safeguard the personal information of Canadians. 
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UPDATE ON PRIVACY ACT REFORM: 
FIRST STEPS TOWARD LEGISLATIVE OVERHAUL 


OPC proposes a series of “quick fixes” to improve Canada’s public sector privacy 
legislation in the short term 


Privacy Commissioners have been calling for reform of the Privacy Act for many years 
now and the increasingly urgent need for modernization of the legislation has become a 
regular theme of our annual reports. 


This year is no different. Our current legislation does not adequately protect the personal 
information of Canadians held by government departments and agencies. 


In 2006, our Office issued a comprehensive report detailing recommended changes to 
the Privacy Act. 


Since then, we have consulted with external stakeholders on this issue. For example, 
we asked the Public Policy Forum to organize two roundtable discussions on reform of 
the federal privacy regime in June and October 2007. These discussions involved senior 
government officials who have a stake in privacy promotion and protection. 


As we were working on this annual report, we received word from the House of 
Commons Standing Committee on Access to Information, Privacy and Ethics that its 
members planned to take a look at the Privacy Act. 


The committee heard from a number of witnesses. Our Office hopes the committee 
members will return to this work in the fall of 2008. 


Given that there seems to be little appetite in government for a major rewrite of the 
legislation, the Commissioner proposed a list of 10 “quick fixes” when she appeared 
before the committee in April 2008. These relatively straightforward changes would 
address some of the legislation’s shortcomings — basics such as introducing a “necessity 
test” for the collection of personal information by government departments. 
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However, the proposals are most emphatically 
not meant to be the definitive statement Our Office sees these 10 


on Privacy Act reform. Our Office sees 
these 10 recommendations as a first step in 


recommendations as a 


modernizing the legislation while we wait for first step in modernizing 
a comprehensive modernization initiative. the legislation while we 


Some of the proposed changes would simply 


wait for a comprehensive 


incorporate into the law existing federal modernization initiative. 
government policies and practices. Treasury 


Board Secretariat has done some good work 

on privacy matters by providing guidance to line departments, for example, on signing 
information-sharing agreements and the outsourcing of personal data processing. 
However, amending the legislation would provide clearer guidance in this regard. 


Other proposed changes would correspond to provisions that already exist in or are 


being contemplated for PIPEDA. 


10 Privacy Act “Quick Fixes” | 


1 


10 


“Necessity test” requiring government institutions to demonstrate need for personal 
information they collect. 


Broaden grounds for an application for Court review under section 41 of the 
Privacy Act; give Federal Court the power to award damages against offending 
institutions. 


Requirement to assess privacy impact of programs prior to implementation and to 
publicly report assessment results. 


Clear public education mandate. 


Greater discretion to report to Canadians on government institutions’ privacy 
management practices. 


Discretion to refuse/discontinue complaints where investigation is not in public 
interest. 


Eliminate restriction that Privacy Act applies only to recorded information. 


Require government institutions to report annually on a broader spectrum of privacy- 
related activities. 


Require ongoing five-year Parliamentary review of Privacy Act. 


Stronger provisions governing disclosure of personal information by Canada to 
foreign states. 
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‘The following is a description of the OPC’s proposed “quick fixes”: 


1 Create a legislative “necessity test” which would require government 
institutions to demonstrate the need for the personal information they collect. 


Background 

This “necessity test” is already included in Treasury Board policies as well as PIPEDA. 
It is an internationally recognized privacy principle found in modern privacy legislation 
around the world. For example, the provinces and territories have adopted a model 

in their public sector legislation requiring that one of three conditions be met: the 
collection is expressly authorized by statute; the information is collected for the purpose 
of law enforcement, or the information relates directly to and is necessary for an operating 
program or activity. 


The Privacy Act currently states: “No personal information shall be collected by a 
government institution unless it relates directly to an operating program or activity of 
the institution.” This sets a disproportionately low standard for the fundamental rights at 
the heart of the Privacy Act. 


What difference would it make? 
By building in better controls at the collection point, there is less potential for misusing 
and disclosing personal information. 


2 Broaden the grounds for which an application for Court review under section 
41 of the Privacy Act may be made to include the full array of privacy rights 
and protections under the Privacy Act and give the Federal Court the power to 
award damages against offending institutions. 


Background 
Currently, the Federal Court may only review a refusal by a government institution to 
grant access to personal information requested by an individual under the Privacy Act. 


Although the Commissioner can investigate complaints concerning the full array 

of rights and protections under the legislation and make recommendations, if the 
response of the institution is not satisfactory, neither the individual nor the Privacy 
Commissioner may apply to the Federal Court for enforcement and remedy. This means 
there are no effective remedies for violations of privacy rights, such as the wrongful 
disclosure of personal information or the inappropriate collection of information. 


This is a far lower standard than in the private sector, where PIPEDA provides such 
remedies for Canadians. 
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What difference would it make? 

Broadening Federal Court review would ensure government institutions respect 
individuals’ rights to have their personal information collected, used and disclosed in 
accordance with the Privacy Act. It would also put the Privacy Act on par with PIPEDA. 


Every right needs a remedy in order to have meaning. 


3 Enshrine a requirement for heads of government institutions subject to the 
Privacy Act to assess the privacy impact of programs or systems prior to their 
implementation and to publicly report assessment results. 


Background 

A 2002 Treasury Board Secretariat policy on Privacy Impact Assessments (PIAs) was 
designed to assure Canadians that privacy principles would be taken into account during 
the development and implementation of programs and services that raise privacy issues. 


Unfortunately, the way in which institutions are implementing this policy has been 
uneven. As reported in our 2006-2007 annual report, an OPC audit found that PIAs 
are not always conducted when they should be and are frequently completed well after 
program implementation, or not at all. 


What difference would it make? 
A legal requirement for PIAs would ensure they are done on a consistent and timely basis. 


As well, PIAs should be submitted to the OPC for review prior to program 
implementation — allowing our Office to offer recommendations on how privacy could 
be better protected. 


4 Amend the Privacy Act to provide the Office of the Privacy Commissioner of 
Canada with a clear public education mandate. 


Background 

While the OPC’s central function under the Privacy Act is the investigation and 
resolution of complaints, the OPC also needs to advance privacy rights by other means — 
through research, communication and public education. The Commissioner lacks a clear 
legislative mandate under the Privacy Act to educate the public about their privacy rights 
with respect to information held by federal government institutions. 


What difference would it make? 

A clear public education authority would allow the OPC to publish public advisories 
and education material on significant policy and legislative measures with “personal 
information” components. 
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PIPEDA contains such a mandate and it is only logical that the Privacy Act contain a 
similar mandate for the public sector. 


5 Provide greater discretion for the Office of the Privacy Commissioner of Canada 
to report publicly on the privacy management practices of government 
institutions. 


Background 

As it now stands, our Office reports to Parliament and Canadians through annual 
or special reports. There is no specific section in the legislation authorizing the 
Commissioner to make public interest disclosures. 


The OPC has been hampered in its ability to speak with the press, the public, and even 
Members of Parliament, due to the existing confidentiality constraints in the Privacy 
Act. 


Waiting until the end of the reporting year to tell Canadians about privacy issues related 
to federal institutions means the information has sometimes become moot, stale or 
largely irrelevant. A clear discretion for public interest disclosures would allow for more 
timely and relevant public discussions about privacy issues important to Canadians. 


What difference would it make? 
‘This discretion would be an important tool for advancing public understanding, 
providing public assurances, and restoring public confidence where required. 


Canadians would have timely information about how the federal government is 
handling their personal information. 


6 Provide discretion for the Privacy Commissioner to refuse and/or discontinue 
complaints the investigation of which would serve little or no useful purpose, 
and would not be in the public interest to pursue. 


Background 

At the moment, valuable resources are still being disproportionately consumed by 
having to open and investigate all individual complaints on a first-come, first-serve basis. 
Examples of complaint types where relatively little is gained by investigating include: 


e Repetitive issues that have already been clearly decided in past cases (e.g. 
legitimate collection and use of Social Insurance Numbers.) 


e Moot time complaints where the individual has since received the information 
requested (e.g. where access was already provided, though technically out of 
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time and at no disadvantage to the individual.) 


e Frequent complaints brought forward by the same individual against an 
institution (e.g. where contentious labour or employment issues constitute the 


real dispute.) 


e Multiple complaints brought by many individuals about the same incident (e.g. 
a large data breach.) 


e Issues that have already been recognized and addressed by a government 
institution. 


Many data protection authorities in Canada and elsewhere face similar challenges 
in having to treat all complaints received indiscriminately, with no ability to dismiss 
or discontinue some of them early on where no public interest would be served by 
investigating or continuing to investigate them. 


What difference would it make? 

This discretion would allow our Office to focus more investigative resources on privacy 
complaints which are of broad systemic interest and affect the interests of a significant 
number of Canadians. 


7 Amend the Privacy Act to align it with the Personal Information Protection and 
Electronic Documents Act by eliminating the restriction that the Privacy Act 
applies to recorded information only. 


Background 

Unrecorded information — such as surveillance cameras that are used to monitor people, 
but do not record images — is beyond the scope of the Privacy Act. Personal information 
contained in deoxyribonucleic acid, known better as DNA, and other biological samples 
is not explicitly covered. 


Under PIPEDA, personal information includes personal information in any form. 


What difference would it make? 

Expanding the definition of personal information would ensure the Privacy Act is 
responsive to the digital imagery and biometric applications of contemporary law 
enforcement surveillance and monitoring activities. It would also offer protection for 


DNA and other biological samples. 
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8 Strengthen the annual reporting requirements of government departments 
and agencies under section 72 of the Privacy Act, by requiring these institutions 
to report to Parliament on a broader spectrum of privacy-related activities. 


Background 

The Privacy Act requires the head of a government institution to submit an annual report 
to Parliament on the administration of the Act. Our experience in reviewing these 
reports over the years indicates that, on the whole, they have rarely contained substantive 
information. Rather, they’ve tended to be a patchwork of statistics about the number 

of Privacy Act requests received; dispositions taken on completed requests; exemptions 
invoked or exclusions cited; and completion times. 


Treasury Board Secretariat issued comprehensive privacy reporting guidelines for 
government institutions in 2005, and updated these in early 2008. The Privacy Act 
should be amended to integrate these guidelines into legislation in order to provide 
them with added weight and authority. 


What difference would it make? 

A more comprehensive coverage of privacy management issues would provide 
Parliamentarians with relevant information to evaluate the extent to which government 
institutions are addressing privacy challenges, and whether new initiatives may pose a 
threat to the privacy rights of citizens. Individuals would also be better informed on how 
government departments and agencies are handling their personal information. 


9 Introduction of a provision requiring an ongoing five-year Parliamentary review 
of the Privacy Act. 


Background 

The privacy landscape is dynamic and constantly evolving. It is not unreasonable to expect 
that Parliament should review the Privacy Act on a regular basis, in light of new technologies 
or government measures that may impact on the right to privacy of Canadians. 


By contrast, PIPEDA requires that the first part of that Act be reviewed every five years. 
A number of provinces have a similar requirement for regular legislative review of their 
public sector privacy law. 


What difference would it make? 

A five-year review requirement would help synchronize the Canadian data protection 
framework across jurisdictions. It would also keep the privacy practices of both private 
and public sector organizations on the minds of Canadian decision-makers and industry. 
Finally, it would ensure federal law keeps pace with rapidly evolving technologies and 
international trends. 
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10 Strengthen the provisions governing the disclosure of personal information by 
the Canadian government to foreign states. 


Background 

Technological advances have made it much easier and less expensive for governments 
to collect and retain personal information about citizens. At the same time, information 
sharing between nations has increased dramatically as governments have adopted 

more coordinated approaches to regulating the movement of goods and people and to 
combating trans-national crimes and international terrorism. 


For example, the Canadian Border Services Agency shares customs information and 
information about travellers entering Canada with other countries, while the Financial 
Transaction and Reports Analysis Centre (FINTRAC) has over 40 agreements with 
other financial intelligence units to share information about suspected money launderers 
and terrorists. 


The Privacy Act does not reflect this increase in international information sharing. It 
places only two restrictions on disclosures to foreign governments: an agreement or 
arrangement must exist; and the personal information must be used for administering or 
enforcing a law or conducting an investigation. 


The Privacy Act does not even require that an information-sharing arrangement be in 
writing, let alone impose any requirements concerning the content of such agreements. 


‘The consequences of sharing personal information without adequate controls were 
dramatically highlighted in the Maher Arar case. 


During the Commission of Inquiry into the Actions of Canadian Officials in Relation 
to Maher Arar, Justice O'Connor concluded it was very likely that, in making the 
decisions to detain and remove Mr. Arar to Syria, U.S. authorities relied on inaccurate 
information about Mr. Arar provided by the RCMP. Justice O'Connor made a series of 
recommendations to strengthen RCMP policies and practices when sharing information 
with other government authorities. 


The Government of Canada and Parliament should consider specific provisions to define 
the responsibilities of those transferring personal information to other jurisdictions and 
to address the adequacy of protection in those jurisdictions. 


What difference would it make? 


Good controls on information sharing would minimize the risks to Canadians. Better 
control would serve to ensure that information being shared is relevant and accurate, 
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that appropriate caveats are given, circumscribing the use of the information only for the 
purpose for which it was shared. 


Conclusion 


These 10 straightforward changes would begin the process of aligning the Privacy Act 
with modern data protection legislation around the world. 


Our Office hopes that Canada will one day regain the leadership role in privacy 


promotion and protection it once held, when the Privacy Act was first adopted some 25 
years ago. 
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PROACTIVELY SUPPORTING PARLIAMENT 


A key part of the OPC’s mandate under the Privacy Act is to support Parliament's 
work by providing information and advice on privacy issues 


National security initiatives continued to raise privacy concerns in 2007-2008 and 
were a key focus of our work with Parliamentarians and officials in many government 
departments. 


National security issues of particular note were Canada’s new no-fly list, the 
government’s lawful access consultations and plans for enhanced driver’s licences in 
some provinces. 


From our Office’s point of view, one of the bright spots in the area of law enforcement 
was the introduction of legislation aimed at tackling identity theft. 


The OPC also provided input on a number of other issues during the year, including 
possible amendments to copyright legislation and the development of electronic health 
records. 


LAW ENFORCEMENT AND NATIONAL SECURITY INITIATIVES 


It is impossible to overstate how privacy rights around the world have been rolled 

back since the terrorist attacks of Sept. 11, 2001. Governments everywhere — Canada 
included — have responded with a wide range of national security initiatives, which often 
focus on gathering more and more information about the routine, day-to-day activities 


of ordinary people. 
Governments appear to believe that the key to national security and public safety is 


collecting, sorting and analysing mountains of personal data — without demonstrating 
the effectiveness of doing so. 
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Privacy often receives short shrift as new 
anti-terrorism and law enforcement initiatives Privacy often receives 
are rolled out. This trend continues several 


years after the 9-11 tragedies. short shrift as new 
anti-terrorism and law 
Canadians expect the government to take enforcement initiatives 


measures to protect them; equally, they expect Seevelled out. This trend 
these measures will respect their rights, 

including their right to privacy, and also continues several years 

conform to the rule of law. This includes legal after the 9-11 tragedies. 

standards, such as due process, the right to 

consult counsel, the right to see evidence held 

against you and other elements of procedural fairness that underpin our justice system. 


The following is a summary of some of the top national security and law enforcement 


issues of 2007-2008: 
No-Fly List 


Much of the post 9-11 focus has been on air travel security. In Canada, the federal 
government created a no-fly list which raises profound concerns about not only privacy, 
but other related human rights, such as freedom of association and expression and the 


right to mobility. 


Fundamental flaws in the program were highlighted within days of the no-fly list, or 
Passenger Protect Program, coming into force in June 2007. 


Two Canadian boys with the same name became entangled by North America’s no-fly 
lists because they share the name of someone on one of these lists. 


‘Their stories were similar: Alarm bells went off when each boy arrived at an airline 
check-in counter to try to catch a flight. The boys’ families were told there was a security 
issue because of a name match with a no-fly list. (It was unclear which list they were 
on.) Both boys were allowed to fly after lengthy delays, apparently because their ages — 
10 and 15 — made it clear they posed no threat. 


An airline official warned one of the families there would be trouble each time their son 
tried to fly in the future and proposed a dramatic solution — changing his name. 


‘The Passenger Protect Program involves the secretive use of personal information 


and, despite this significant intrusion on our privacy rights, Canadians have no legally 
enforceable rights to independent adjudication, compensation for out-of-pocket 
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expenses or other damages, or to appeal. Canadians also have no right to ask whether 
they are even on the list. 


The government has said the list includes up to 2,000 names. There is clearly a 
significant risk for false positives — a problem we have seen in the US, where children 
and public figures such as Senator Edward Kennedy have faced questioning or been 
denied boarding. 


Our Office has been clear that it will not stand in the way of initiatives which will 
protect the lives of Canadians. However, despite our repeated requests, Transport 
Canada has provided no evidence demonstrating the effectiveness of no-fly lists. 


Some security experts suggest that improving physical screening at our airports — 
including thorough luggage and cargo checks — would be a more realistic and effective 
way to enhance aviation security. 


An audit of the privacy management practices of the Passenger Protect Program is 
planned. 

Shortly after the no-fly list came into effect, Canada’s i arnation about our 
federal, provincial and territorial privacy commissioners 
and ombudsmen united to call for extensive reforms 

to the program. In a joint resolution, we called for the Protect program is included on 
program to be suspended, or, at a minimum, to operate page 82. 

under strict ministerial scrutiny with regular public 

reports to Parliament while a comprehensive public Parliamentary review is completed. 


review of the Privacy Impact 
Assessment of the Passenger 


Privacy officials around the world share similar concerns about the widespread use of 
no-fly lists, as well as the collection and sharing of passenger data. 


Data protection authorities attending the 29" International Conference of Data 
Protection and Privacy Commissioners in Montreal hosted by our Office supported 
a resolution calling for international standards for the use and disclosure of personal 
information collected by a travel carrier about its passengers. 


The no-fly list was also a major focus when the Privacy Commissioner appeared before 
the Commission of Inquiry into the Investigation of the Bombing of Air India Flight 
182 in November 2007. We urged the Inquiry to consider the need for clear legal 
remedies, enforceable safeguards, and effective oversight as it assesses the adequacy of air 
travel security measures. 
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Lawful Access 


In October 2007, Public Safety Canada issued a brief consultation paper on 

lawful access and difficulties faced by law enforcement agencies in obtaining 
customer information such as name, address, telephone number or IP address from 
telecommunications service providers. 


Some companies provide this information voluntarily, while others require a warrant 
before providing any information, regardless of its nature or the nature of the situation. 


The Public Safety Canada consultation document says this is making the job of police 
officers challenging because they may have no means to compel the organizations to 
provide the information they are seeking. 


“For example, law enforcement agencies may require the information for non- 
investigatory purposes (e.g., to locate next-of-kin in emergency situations) or because 
they are at the early stages of an investigation. The availability of such building-block 
information is often the difference between the start and finish of an investigation,” the 
consultation paper said. 


The consultation document does not provide any sense of the scope of the difficulties 
mentioned in the document. Are 20 per cent or 80 per cent of companies providing 
information voluntarily? Do companies respond differently depending on the situation — 
in a next-of-kin emergency situation versus a request involving suspected violent crimes? 
We don’t have the answers to these key questions. 


In our Office’s opinion, requiring all telecommunications service providers to disclose 
customer information on request is an overly broad, one-size-fits-all response to a 
problem that has not been clearly defined or measured. 


Neither this consultation paper, nor previous consultation documents has presented a 
compelling case based on empirical evidence that the inability to obtain customer data 
in a timely way has created serious problems for law enforcement and national security 
agencies. 


Assuming there is a well-documented and empirically demonstrated problem in 
obtaining access to customer information, we are not convinced that requiring 
telecommunications service providers to disclose this information without a warrant is 
the only, or most appropriate, solution. 


It is our view that there is a reasonable expectation of privacy in customer data — making 
any mandatory disclosures or seizures of dubious constitutional validity. 
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Although the consultation paper identified the “absence of explicit legislation” as a 
problem to be addressed, PIPEDA is, in fact, an explicit legislative code which permits 
lawful access by law enforcement and national security agencies while protecting the 
privacy and other rights and freedoms of Canadians. 


PIPEDA allows telecommunications service providers and other organizations to disclose 
personal information without consent to law enforcement agencies without a warrant for 
the purpose of enforcing a law or carrying out an investigation. It also allows disclosures 
without consent in emergencies which threaten someone’s life, health or security. 


Lawful access was the subject of considerable discussion during a five-year review of 
PIPEDA conducted by the House of Commons Standing Committee on Access to 
Information, Privacy and Ethics. In its response, the government indicated there is a 
need to clarify the concept of lawful authority. The government noted that PIPEDA 
currently allows organizations to collaborate with law enforcement and national security 
agencies without a subpoena, warrant or court order. 


Before considering legislation which would make the disclosure of customer 
information mandatory on request, we would strongly recommend that the government 
determine whether clarification to PIPEDA, together with any guidance that may be 
appropriate, could address the perceived problem. 


Lawful access raises fundamental issues for rights such as privacy and the ability to 
communicate freely. Our Office will continue to monitor this issue and to raise our 
concerns with government officials and Parliamentarians. 


Enhanced Driver's Licences 


Plans to consider or implement enhanced driver's licences (EDLs) in several Canadian 
provinces have prompted our Office as well as provincial and territorial privacy 
guardians to express their concerns about privacy and security risks. 


The moves toward enhanced driver’s licences are a provincial response to the U.S. 
government’s requirement that travellers provide proof of identity and citizenship to 
comply with the Western Hemisphere Travel Initiative. 


These developments have raised concerns among federal, provincial and territorial 
commissioners and ombudsmen responsible for privacy. 


A key concern is that personal information of participating drivers should remain 


in Canada and that there is meaningful and independent oversight of how the U.S. 
Customs and Border Protection receives and uses Canadians’ personal information. 
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As well, RFID technology in enhanced driver’s licences poses a potential privacy threat 
because it may permit the surreptitious location tracking of individuals carrying an 
EDL. The technology may not encrypt or otherwise protect the unique identifying 
number assigned to the holder of the EDL and would not protect any other personal 
information stored on the RFID. 


In February 2008, we issued a unanimous joint resolution outlining the steps that 
will need to be taken to ensure the privacy and security of any Canadian’s personal 
information accessed as part of EDL programs. 


In the resolution, we emphasized that Canadian citizens already have access to a well- 
established, highly-secure travel identification document in the form of the Canadian 
passport, but acknowledged that some may want an alternative. 


Identity Theft 


New legislation aimed at addressing identity theft represents a significant step forward 
in tackling this growing crime. 


A central notion of privacy is that people should be able to control how, when and 

for what purposes their personal information is used. Victims of identity theft have 
clearly lost control over their personal information — with often serious and long-lasting 
consequences. Their privacy has been violated in a very significant way. 


Identity theft is a complex problem, with many contributing factors. 


Bill C-27 focused on the early stages of identity theft and addressed a number of 


different ways in which criminals gather personal information. For example, it: 


e Makes it an offence to possess or traffic in identity information when this 
information is to be used for a fraudulent purpose; 


e Tackles a common technique used by identity thieves — mail re-direction — by 
making it an offence to fraudulently redirect anything sent by post; and possess 


a mail key; 


e Addresses credit card fraud by creating a new offence dealing with the 
possession of instruments for copying credit card information; and 


e Makes the obtaining, selling or possessing of “identity documents” that relate to 
another person an offence, punishable by up to five years in prison. 
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These changes will provide police officers with important new tools to stop identity 
thieves or fraudsters defore Canadians suffer actual financial harm. 


Another praiseworthy element of the legislation is the possibility that offenders will be 
required to pay restitution to victims. This is significant in that it recognizes the serious 
financial impact identity theft can have on individuals. 


It is our view, however, that this identity theft bill is only a beginning and that other 
types of legislative changes are also necessary. 


For example, a key issue not addressed in Bill C-27 is pretexting — where an individual 
obtains personal information, such as telephone or financial records, by pretending to be 
someone authorized to have it. We also need to legislate against spam — often used by 
identity thieves to trick people into providing personal information online. Canada is 
the only G-8 country without anti-spam legislation. 


OTHER LEGISLATION AND INITIATIVES WITH AN IMPACT ON PRIVACY 


Copyright 
‘The federal government has been studying changes to the Copyright Act for the last few years. 


In January 2008, the Privacy Commissioner wrote to the Minister of Industry and the 
Minister of Canadian Heritage regarding possible amendments to the Act. 


In particular, our Office is concerned about possible changes authorizing the use of technical 
mechanisms to prevent copyright infringement that could have a negative impact on the 
privacy rights of Canadians. In some cases, such mechanisms to protect copyrighted material 
result in the collection, use and disclosure of personal information without consent. 


Technological protective measures can be embedded in various media to control copying 
and prevent copyright infringement, or they can be built into electronic devices to 
prevent the reading of unauthorized content. 


Digital rights management is the general term for the varied technologies used to 
enforce pre-defined limitations on the use of digital content. These include any means by 
which publishers or manufacturers control use of data or hardware. 


If digital rights management technologies only controlled copying and use of 

content, we would have few concerns. However, they can still collect detailed personal 
information from users, who often access the content on a computer. This information 
is transmitted back to the copyright owner or content provider, without the consent or 


knowledge of the user. 
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Although the means exist to circumvent these technologies and thus prevent the 
collection of this information, previous proposals to amend the Copyright Act contained 
anti-circumvention provisions. 


Technologies that report back to a company about the use of a product reveal a great 
deal about an individual’s tastes and preferences. Indeed, such information can be 
extremely personal. 


Our Office will carefully assess the privacy implications of any legislation to amend the 
Copyright Act. 


Electronic health records 


The federal government is encouraging the development of a system of electronic health 
records through the Federal Healthcare Partnership. 


We are monitoring the progress of this group, which would impact the health care 
services provided to First Nations and Inuit populations, eligible veterans, members of 
the Canadian Forces, RCMP, federal inmates and refugee protection claimants. 


As well, our Office is an active participant in the new Canada Health Infoway Privacy 
Forum, which brings together representatives of the health ministries and privacy 
oversight offices across Canada. The Forum is discussing fundamental privacy and 
governance issues that must be addressed to ensure the successful implementation of 
electronic health records. 


Infoway’s goal is to ensure that, by 2010, half of Canadians will have their electronic 
health record readily available to health care providers. 


While electronic health records offer significant benefits, such as rapid access to complete 
patient information for health professionals, they also raise a number of privacy risks. 


‘The protection of privacy must be a key factor as we consider how these highly sensitive 
records are managed. It is crucial that patients know what is happening to their health 
information and feel confident that they can exercise a measure of control over it. 


Electronic health records will require extremely strong security measures, including 
safeguards to ensure only authorized people can access the information. Careful 
attention must also be given to potential secondary uses for the information, including 
health research. 
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How the OPC dealt with complaints and incidents under the Privacy Act in 2007- 
2008 


‘The complaints we receive show Canadians have a wide range of concerns about how the 
government is handling their personal information. 


Canadians are uneasy about the sharing of information between departments; the use of 
e-mail to record and/or share information; and the problems associated with institutions 
maintaining and properly allowing individuals a right of access to personal information 
stored on computers. 


We have also noticed a growing concern about how government institutions are 
protecting their information. Headlines about personal information being lost or stolen 
when public servants telework or bring home work on laptops do not inspire public 
confidence. 


‘The cases we investigated over the year also highlighted how human error can jeopardize 
personal privacy. Some of the breaches we looked at show how problems with computers 
and use of other mechanized equipment designed to improve government processes can 
result in the disclosure of personal information. It is also clear that government 
institutions must continue to emphasize to employees the importance of safeguarding 
personal information and privacy. 


Another issue which continues to concern our Office 

is ongoing delays in processing individuals’ requests 

for access to their personal information. While some 
departments have improved their response times, many 
federal Access to Information and Privacy (ATIP) units 
are overwhelmed. chart describing the course of 


a Privacy Act investigation are 


NOTE: Detailed statistical charts; 
definitions of each type of 
complaint and findings; and a 


included in the Appendices. 
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Snapshot: Inquiries, Complaints and Investigations 


Privacy Act inquiries received: 4,258 
General privacy inquiries: 2,367 
Total (excludes PIPEDA inquiries): 6,625 


Complaints 
Total new complaints received: 759 


Top 10 institutions by complaints received 


Correctional Service Canada 248 
Royal Canadian Mounted Police 84 
Canada Border Services Agency 54 
Service Canada 52 
National Defence 48 
Canadian Security Intelligence Service 45 
Canada Revenue Agency 38 
Canada Post Corporation 28 
Foreign Affairs and International Trade Zi 
Justice Canada 18 
Others 117 
Total 759 
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Inquiries 


Our Office received a total of 4,258 inquiries related to the Privacy Act and another 
2,367 more general inquiries about privacy in 2007-2008. These figures do not include 
the 7,636 inquiries related to PIPEDA, the legislation applying to the private sector, 
received in 2007. The average daily number of inquiries we receive about all privacy 
issues is close to 60. 


Our inquiries unit provides an extremely Our inquiries unit provides 
important service to Canadians, who are an extremely important 
able to obtain a timely response to questions 


ean d f ori : service to Canadians, who 
OuCc Ing on a wide array (@) privacy issues. 


are able to obtain a timely 
Complaints response to questions 


We received 759 new complaints, down touching on a wide array 


slightly from the previous year’s 839. of privacy issues. 


The number of complaints filed against institutions does not necessarily mean that these 
institutions are not compliant with the Privacy Act. 


Some institutions — because of their mandate — hold a substantial amount of personal 
information and are more likely to receive numerous requests for access to that 
information. There is also a higher likelihood of complaints about the institution’s 
collection, use and disclosure, retention and disposal of personal information, and the 
manner in which it provides access to that information. 


Correctional Service Canada and the RCMP have been the top two institutions 
receiving complaints over the past few years. It is noteworthy that there has been a 
steady drop in the number of RCMP complaints, but a fairly significant increase in 
Correctional Service Canada complaints — from 190 in 2005-2006 to 248 in 2007- 
2008. The rise in the number of complaints against Correctional Services Canada may 
be directly proportional to the additional access to personal information requests it 
received. 


A complete list of complaints received by institution can be found in Appendix 3. 


The majority of all new complaints were from individuals who claimed that federal 
government institutions denied them a right of access to their personal information. 
The second most common type concerned the 30-day statutory time limit (extended 
to 60 days in some circumstances) for institutions to respond to a personal information 
request. 
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Detailed information about complaints received by type can be found in Appendix 3. 


Closed Complaints in 2007-2008 


Total 880 
Denial of access 318 
Time Limits Exceeded 301 
Improper use / disclosure of personal information 134 
Discontinued TA. 
Early resolution 32 
Settled during the course of investigation 114 
Resolved 6 
Not well-founded 275 
Well-founded 319 
Well-founded and resolved 17 
Total 880 


Individuals may discontinue their complaints because they have resolved the issue with 
the institution before the active investigation has begun. Our Office may also discontinue 
complaints due to a lack of information necessary to complete our investigations. When a 
complaint is resolved through early resolution or by settling, this indicates the individual is 
satisfied with the actions taken by the institution as a result of our intervention. 


Obtaining Access to Personal Information 


Obtaining access to personal information held by a government institution is a basic 
privacy right that is afforded to individuals under the Privacy Act. However, it is clear 
many Canadians are having difficulties exercising this right. More than 70 per cent of 
the complaints filed with this Office related to individuals expressing concern about 
being denied access to their personal information or because institutions failed to 
provide that information within the statutory time limit. 


Our Office is pleased to see that the total number of complaints in both these categories 
has declined over the last few years. This may be because individuals are dealing directly 
with institutions to resolve their concerns, a practice that our Office encourages. 
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Time limit complaints are opened when an individual notifies this Office that an 
institution has failed to respond to his or her Privacy Act request within 30 days. In some 
cases a year had passed without the institutions responding to individuals’ requests. One 
complainant had been waiting for more than two years for a response to his request. 


Investigations and Inquiries Challenges 


Our Office is facing its own challenges in responding to complaints in a timely way. We 
are strongly committed to improving our complaint treatment times. 


In 2007-2008, we received 759 complaints and closed 880. We had a backlog of 370 
complaints that were unassigned because of a lack of investigators. On average, it took 
14.5 months to complete a complaint investigation. We know this is unacceptable and 
are undertaking a number of measures to remedy the situation. 


A detailed breakdown of the treatment times by finding and complaint type can be 
found in Appendix 3. 


We are challenged by the fact that, under the wording of the Privacy Act, we need to 
deal with every complaint we receive. Other data protection authorities around the 
world and in Canadian provinces are also finding similar challenges with the need to 
address all complaints received — regardless of their nature or seriousness. 


Our Office has asked the federal government for legislative amendments to provide us 
with this flexibility, a step that would allow us to better focus our investigative resources. 
(See page 45 for more detailed information.) 


Another major challenge is attracting and retaining seasoned investigators and managers 
in this area. People with Privacy Act and investigation experience are in high demand 
across government and there are not enough qualified individuals to go around. An older 
generation is retiring and the new generation is extremely mobile in a competitive job 
market. Turnover rates in this area have been higher than elsewhere in the OPC due to 
retirement and external demand. 


We are continuing to revitalize our investigations unit by focusing our efforts on 
recruitment, as well as looking at innovative means to improve service delivery to 
Canadians. 


Our strategy includes re-engineering our investigative process by streamlining inquiries, 
complaints and investigations. We will triage complaints and identify those which could 
likely be resolved early in the process. A new case-management system will help us to 
better identify trends and focus resources where they can have the most impact. 
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We anticipate it will take a year to build capacity, diminish the backlog, continue hiring 
and training more staff to investigate in innovative ways. Our goal is to complete the 
re-engineering initiative in the spring of 2009. 


Training and Inter-jurisdictional Cooperation 


Training will play an important role in our continuous efforts to improve how we 
investigate and attempt to resolve complaints about privacy breaches. 


In February 2008, we hosted our fourth annual investigators conference. We welcomed 
more than 90 participants at this Ottawa event, including representatives from 12 of the 
13 provincial and territorial privacy offices, and, for the first time, members of the Office 
of the Information Commissioner of Canada. The conference allowed investigators to 
share experiences and best practices. Open and frank discussions increased awareness of 
common issues. 


Complaints — Examples of Cases the OPC Investigated 


Passport Canada apologizes for “unacceptable error” 


The complainant mailed his passport renewal application to Passport Canada. As 
required, he provided his expiring passport, photocopies of his driver's licence and health 
card, and his original birth certificate. When he received his new passport in the mail, the 
envelope contained another person’s expired passport and other personal documents. 


The individual notified Passport Canada of the error. The agency asked him to return 
the other individual’s documents, which he did, and said that it would search for his 

documents. Passport Canada contacted the other individual and learned that he had 

destroyed the complainant’s documents. 


Our investigation determined that a passport employee had mixed up the contents of 
two files and then failed to check that the labelled envelope, new passport and other 
documents all matched the intended recipient. 


Passport Canada apologized for what it acknowledged was an “unacceptable error” and 
said it had taken steps to ensure it did not happen again. Managers now hold monthly 
briefings with staff to verify that proper procedures are being followed. In addition, 

the agency posts the procedures and all new employees are trained and instructed on 
the importance of verifying documentation prior to it being placed in an envelope and 
mailed to a recipient. 


The complaint was well-founded. 
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Inmate report discovered in prison gym garbage can 


A report containing pictures, names, birthdates and cell locations of 96 inmates, as well as 
other personal information, was found in an offender's cell at an Alberta prison. Fourteen 
affected inmates complained to our Office. 


An offender had discovered the report in a garbage can in the prison’s gym. Correctional 
Service Canada’s investigation determined that this report was routinely updated and 
posted for correctional officers in an office next to the gym. Out-of-date reports were 
being regularly discarded in the gym’s garbage can. 


To ensure that such a disclosure does not occur again, Correctional Service Canada 
instructed the institution to stop posting this type of information in the office next to an 
area used by offenders and to take greater care with personal information. 


The complaint was well-founded. 


Canada Revenue Agency employee misuses information 


A woman complained that her former neighbour, who worked for the Canada Revenue 
Agency, improperly gained access to her tax files in order to identify her place of 
employment and then used this information to make harassing and threatening phone 
calls. 


The complainant had a history of problems with the Canada Revenue Agency employee. 
She stated that the employee and her family had threatened and harassed her for years. 
The complainant moved and obtained an unlisted telephone number. After her move, 
she began receiving harassing calls at her place of work. She determined that these 
originated from the Canada Revenue Agency employee. 


‘The agency confirmed that its employee had used her position to gain access to 

the complainant’s personal information. This included the complainant’s address, 
Social Insurance Number, place of employment, income and deductions. The agency 
confronted the employee about her actions and she confirmed she had viewed the 
complainant’s tax information. She was disciplined for the unauthorized access to the 
complainant’s personal information. 


The CRA has an extensive audit trail process allowing it to maintain the security of 
taxpayers’ information. 


The complaint was well-founded. 
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Identity of information requester revealed 


A Foreign Affairs and International Trade Canada (DFAIT) employee complained the 
institution improperly disclosed his personal information to co-workers. The co-workers 
then disclosed it to the Public Service Alliance of Canada. 


In addition to being a DFAIT employee, the complainant’s union work had been 
criticized by the local’s executive and some members. The complainant submitted 
Privacy Act requests seeking all personal information held by five co-workers, who were 
also his fellow union members and the ones who had criticized him. 


When DFAIT received his requests, the ATIP unit asked the co-workers to provide 

all personal information they held about the complainant. ATIP staff alerted the co- 
workers of the sensitivity of the request and informed them of the restriction for further 
dissemination of that information on a “need-to-know” basis within the institution. 


The first issue our Office reviewed was the complainant’s concern about being identified 
as the requester. We concluded this complaint was not well-founded. In order to obtain 
the information held by the co-workers, the ATIP unit needed to disclose his identity. 


As for the complainant’s concern about the co-workers notifying the union that he had 
submitted Privacy Act requests, our investigation confirmed that four of the five had 
informed the Public Service Alliance of Canada of his actions. The co-workers believed 
that the complainant had submitted his requests in an effort to harass them. All four 
confirmed they had read the ATIP unit’s reminder about the sensitivity of his request, 
but considered the matter union business, not departmental business. 


While the disclosure of the complainant’s identity to his co-workers was not well- 
founded, the fact that four co-workers notified the union that he had submitted Privacy 
Act requests violated his privacy rights. 
The complaint was well-founded. 
Monitoring of employees e-mails was appropriate 
An Indian and Northern Affairs employee complained that the institution did not have 
the authority to restore 35 months of the employee's e-mails and then review all of the 
messages contained in the departmental account. The employee alleged that as a result of 


the department's actions, the employee's personal information was improperly accessed. 


‘The employee was the subject of an administrative investigation into allegations that the 
employee was misusing the department’s network. 
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During the course of its investigation into the complainant’s actions, the institution 
restored the complainant’s e-mail account and found pornographic e-mails. 


Later, the employee received a copy of the Terms of Reference for the administrative 
investigation and noted that it was not signed. The employee contended that, as the 
document was not signed, the institution had no authority to restore or read the e-mails. 
The employee also contended that there should have been notification of the insitution’s 
actions. 


Treasury Board’s policy states that if an institution reasonably suspects that an individual 
is misusing a department’s network it must refer the matter for further investigation 

and action which may involve special monitoring and/or reading the contents of an 
individual’s e-mails. 


Indian and Northern Affairs policy states that management is permitted to have access 
to an employee’ e-mail in the course of any investigation relating to impropriety, security 
breaches, violation of a law or infringement of departmental policies. 


Although the Terms of Reference were not signed and the employee was not advised 
of the institution's actions, Indian and Northern Affairs did not violate Treasury 
Board’s policy on network use or the employee’s privacy rights. Under the Privacy Act, 
institutions may use personal information for the purpose for which it was obtained 
or compiled or for a use consistent with that purpose. In this case, the information 
gathered from the employee’s e-mail account was used solely for the purpose of the 
institution's administrative investigation. 


The complaint was not well-founded. 


Reporter identified in response fo access request 


A journalist complained that his name had been improperly released in a response to 
a request made under the Access to Information Act (ATIA). The name of the journalist 
appeared in an e-mail message prepared by a Privy Council Office employee. 


The e-mail came to light after another reporter requested access to all e-mails and 
communications sent or received by the director of communications in the Prime 


Minister's Office. 
The response to that request included an e-mail from an employee of the Privy Council 


Office (PCO) to 19 government officials in both the PCO and the Prime Minister's 
Office. 


67 


Awnuat Report To ParLiaMENT 2007-2008 — Report oN THE Privacy Act 


The e-mail was written after a multi-department conference call during which an 

official with Public Safety Canada discussed the pending release of information about a 
sensitive issue in response to an ATT request. In the e-mail, the PCO official discussed the 
possibility of another article being written by the complainant about a sensitive issue that 
he had previously reported on. Other reporters’ names were also mentioned in the e-mail, 
primarily concerning stories that had already appeared in print. While their names were 
blacked out, the complainant’s name had been overlooked and released in error. 


The Privy Council Office subsequently apologized to the complainant. 


As the complainant’s name was released to the other reporter in response to an ATI 
request, the OPC concluded that his privacy rights had been violated. The complaint 


was well-founded. 


A related complaint alleged that the PCO official disclosed that the journalist had filed 
an ATT request to Public Safety Canada during the multi-department conference call. 


However, our investigation confirmed that the ATI requestor’s identity was never 


disclosed outside of the ATIP office of Public Safety Canada. 


The PCO official stated he had simply made an assumption about who had made the 
request based on the fact that the journalist had written a number of articles on the 
subject. 


The Assistant Commissioner was satisfied that the journalist’s identity as the person 
making the access request was not under the control of PCO. This complaint was not 
well-founded. 


A third complaint from the same journalist against Public Safety Canada that it had 
disclosed his name as an ATI requester was also not well-founded. That complaint was 
closed in the previous reporting year. 


Improper disclosure of information to prospective employer 


A man contended that Human Resources and Skills Development Canada (HRSDC, now 
Service Canada) improperly provided his Social Insurance Number, address, birth date, 
income information and employment insurance application details to a prospective 
employer. 


While receiving employment insurance (EI) benefits, the complainant turned down 


a job offer from a company. As a result, HRSDC disqualified his EI benefits. The 
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complainant appealed its decision to the Board of Referees. He claimed that he had 
refused the job because of working conditions. 


In accordance with the Employment Insurance Act, when an individual appeals a decision 
to the Board of Referees, HRSDC may share that individual’s information with 
interested parties such as employers and any person with a vested interest. The disclosure 
of information to these parties is necessary to establish the validity of an individual’s 
request for continuation of EI benefits. 


In this case, HRSDC deemed that the prospective employer was a party to the 
complainant’s appeal and gave the company a complete package of information. 
HRSDC did not review the complainant’s file and released his Social Insurance 
Number, birth date and information relating to his past employment record, including 
rates of pay and overtime. As the complainant’s appeal to the Board of Referees was 
based on refusing the job offer because of working conditions, the information released 
by HRSDC to the parties should have been limited to what was required to establish 
the validity of his decision to refuse that job offer. 


HRSDC agreed that it had released too much information, calling the incident an “honest 
mistake made in good faith by an employee.” As a result of this complaint, it reviewed its 
policies and procedures and changed the definition of employer to include “a current or 
former person or organization for whom the claimant worked.” A prospective or potential 
employer is no longer considered an interested party in the appeal process. 


‘The complaint was well-founded. 


Incidents under the Privacy Act 


Our Office also reviews cases involving the mismanagement of personal information 
which come to our attention through media reports, affected individuals or breach 
notifications from government institutions. 


Data breaches 


Treasury Board Secretariat published privacy breach guidelines for institutions subject 
to the Privacy Act at the end of March 2007. The guidelines “strongly recommend” 

that government institutions notify the OPC if a breach involves sensitive personal 
information such as financial or medical information or Social Insurance Numbers or if 
there is a risk of identity theft or some other harm or embarrassment which could have 
an impact on an individual's reputation, financial position or safety. 
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During the first year in which the guidelines have been in place, we have noticed 

an increase in the number of reported incidents (57 in 2007-2008 as compared to 

43 for 2006-2007). The fact that the number of incidents is relatively low, when one 
considers the large amount of personal information held by government institutions, is 
encouraging news. 


Most incidents occurred as a result of human error or theft, for example, when 
documents containing someone’s personal information were lost, or when a government 
employee’s briefcase was stolen from a hotel room or a laptop was taken from a vehicle. 
In one instance, employees gained unauthorized access to personal information stored 
on government computer systems. 


‘The following are some typical incidents we reviewed: 


Technology glitch results in disclosure of sensitive information 


A failed effort by Public Works and Government Services Canada (PWGSC) to remove 
exempted information when it respond to Access to Information Act (ATIA) requests 
using CDs rather than paper format compromised a number of individuals’ personal 
information. 


Over the last number of years, institutions have been responding to some Access to 
Information Act and Privacy Act requests by sending the information on CDs rather than 
in paper format. At PWGSC, the CDs were scanned in “Tagged Image File Format” 
(TIFF), which is a picture copy of the document. The imaging program was changed 

to “Portable Document Format” (PDF) when requesters complained about having 


difficulties in opening TIFF files. 


‘The recipient of one of the CDs that contained the information in PDF format 
informed the institution he was able to read the information that had been exempted. 
He said that he simply selected the severed portions and pasted them into another 
document. 


Before this problem was brought to its attention, the institution had responded to 123 
ATTA requests and one Privacy Act request using the PDF format. As a result, people 
who received the CDs were able to read the names and home addresses of government 
employees being investigated for fraud involving government credit cards, the names 
and birth dates of people undergoing security clearances, the results of second language 
evaluations and employee leave information. 


In an effort to minimize any further disclosure, PWGSC attempted to retrieve the 
CDs from requesters. Some requesters did return the CDs, while others said they had 
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destroyed or lost them. Individuals whose personal information was at risk were notified 
by the institution of the potential breach. 


It was determined that the problem was a flaw in an imaging system. The manufacturer 
of the software was contacted and confirmed that PWGSC was the only institution with 
a flawed version. That being said, to ensure that this did not occur in another institution, 
Treasury Board prepared a general security bulletin warning institutions not to release 
information on CDs until they received certification that their programs were secure. 


Stolen laptop contains household survey information 


An encrypted laptop stolen from a Statistics Canada employee’s home contained the 
personal information of several Canadians who had taken part in surveys. Unfortunately, 
the employee had written down the two passwords required to access the laptop's 
information on a Post-it note stored in the computer's case. 


The laptop contained a total of six Labour Force Survey and Canadian Community 
Health Survey cases. The labour surveys contained contact information, household 
information, rent, employment and income and demographic information, while the 
health surveys contained highly sensitive personal information including height, weight, 
sleep patterns, sexual behaviours, chronic conditions, stress, use of tobacco and alcohol, 
illicit drug use and mental health information. 


The employee immediately reported the theft to police. Statistics Canada officials 
visited each of the affected households and informed the residents that their personal 
information had been compromised. 


The department addressed the issue in an appropriate manner with the employee whose 
laptop was stolen. The department also sent out a newsletter to all field employees 
reminding them of their obligations to secure laptops and control the use of their 
passwords, user identification, and computer accounts. Our Office was satisfied with the 
measures implemented by Statistics Canada. 


Human error compromises taxpayers information 


After using the Canada Revenue Agency's telephone service to inquire about information 
related to his Registered Retirement Savings Plan, an individual received an envelope 
containing the Notices of Assessment of nine other taxpayers. 


The man called the agency to report the problem, but had trouble communicating 


with the telephone agent. He asked to speak to a supervisor, but was initially refused. 
A supervisor called back, asking him to return the documents. The man was left with 
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the impression that the agency was not taking the matter seriously and contacted two 
television stations. 


Camera crews recorded the man personally returning a Notice of Assessment to one 
individual who lived nearby and bringing the other documents to a Canada Revenue 
Agency office. 


Following the incident, Canada Revenue Agency reviewed its procedures and policies 
involving documents prepared for faxing and mailing and made corrections. The agency 
also apologized to the affected taxpayers. 


Our Office concluded the incident was the result of human error. 


Failure to reset envelope-stuffing machine leads to privacy breach 


An employee of a private company which administers the Veterans Independence 
Program for Veterans Affairs Canada forgot to reset an automated envelope stuffing 
machine, a mistake which meant 122 cheques were double-stuffed into 61 envelopes. 


The company investigated the incident and put in place a new quality assurance system. 
It now documents the number of cheques handled each day and it reconciles the 
number of cheques printed against the number of envelopes prior to their mail-out. 
Any discrepancies in the numbers will result in immediate investigation and correction. 
In addition, it implemented a policy whereby it now individually stuffs envelopes 
containing reimbursement cheques. 


Veterans Affairs Canada telephoned the affected veterans to check on the status of their 
cheques, and the company sent out apology letters. Cheques were either redirected to 
the proper recipients or new cheques were issued. 


Our Office reviewed Veterans Affairs’ report on this incident and was satisfied with 


the action it took to notify the affected individuals and the measures it implemented to 
ensure that this type of error isn't repeated. 


Public Interest Disclosures under the Privacy Act 
When there is a compelling public interest that outweighs an individual’s personal 
privacy, the heads of government institutions may, under the Privacy Act, use their 


discretion to disclose personal information without an individual’s consent. 


Unless the situation that arises is an emergency, institutions disclosing personal 
information in the pubic interest must notify the Privacy Commissioner in advance. 
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After reviewing the proposed disclosure, the Commissioner may, if she deems it 
necessary, notify an individual of the release of his or her personal information. The 
OPC will also recommend ways to minimize the amount of personal information being 
disclosed if we feel a department’s proposal to release personal information goes beyond 
the public interest. 


In 2007-2008, our Office reviewed 83 public interest disclosure notices. Most were 

from the RCMP and involved high-risk offenders being released from prison and who 
police believed were a danger to the community. In other instances, the RCMP released 
personal information to the public in order to locate suspects or provide a warning about 
the actions of a violent or sexual offender. 


In other cases, the Department of National Defence and Correctional Service Canada 
released information about the death of individuals to family members. Information 
about the nature of those deaths is provided for compassionate reasons. 


Other Examples of Public Interest Disclosures 

Tuberculosis scare prompts identification of passenger 

The Department of Foreign Affairs and International Trade informed our Office it had 
released to the Public Health Agency of Canada the identities and contact information 
for 27 people who had been seated close to an airline passenger with infectious 


tuberculosis for more than eight hours during an international flight. 


The Public Health Agency was then able to contact passengers from the flight to advise 
them of the need to be tested for tuberculosis. 


In this case, the disclosure in the public interest clearly outweighed any potential 
invasion of an individual’s privacy. 


Auditor General identifies Quebecs Lieutenant Governors misuse of funds 
The Office of the Auditor General of Canada informed our Office that it intended to 
release personal information about the Lieutenant Governor of Quebec’s improper use 


of federal public funds. 


The Auditor General based her decision on the opinion that releasing the information 
was in the public interest. Our Office concluded no further action was necessary. 
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Military Ombudsman releases report about Canadian Forces snipers 


The office of the National Defence and Canadian Forces Ombudsman informed our 
Office that it intended to release a report entitled: 4 Snipers Battle —A Father's Concern 
—An Investigation into the Treatment of a Canadian Forces Sniper Deployed to Afghanistan 
in 2002 — Special Report to the Minister of National Defence and the Chief of the National 
Defence Staff: 


‘The report concerned allegations made by the father of one of six officers in a sniper 
unit. He alleged the officers were ostracized, treated unfairly, denied stress debriefings 
and subjected to unfounded criminal and other investigations. 


Two individuals named in the report consented to the release of their personal 
information. The Ombudsman believed it was possible to identify other individuals 
mentioned, but not named. However, he believed that disclosing the report was in the 
public interest and outweighed any invasion of privacy. 


The Ombudsman’s office notified four people about the report’s impending release 

and gave them each a copy. The OPC reviewed the matter and recommended the 
Ombudsman’s Office inform the two other individuals about the report’s release and the 
possibility they could be identified. The Ombudsman’s office agreed. 


Complaints Commission report reveals personal information 


The Military Police Complaints Commission is an independent federal body that 


oversees and reviews complaints of conduct of members of the Military Police. 


The Complaints Commission received a complaint from a member of a sniper unit 
deployed to Afghanistan expressing concern about the conduct of the Military Police. 
The Commission investigated the allegations made against the Military Police and 
notified the OPC that it intended to disclose personal information contained in its 
report by posting it on its website. The Complaints Commission argued the report 
contained information crucial to the public interest. 


The Commission had determined the allegations against military police officers were 
unfounded. 


The complainants, the members of the Military Police, the Minister of National 
Defence and other departmental officials received copies of the report before it was 
posted, and were told it would be made public. Other individuals named in the report as 
having been interviewed during the investigation were not notified. 
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The OPC recommended that the Commission consider notifying the interviewees of 
its intention to render the report public. We also recommended that the Commission 
depersonalize the report to protect the identities of the parties and interviewees. 
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| AUDIT AND REVIEW | AND REVIEW 


Our Office’s audit work resulted in our first special report to Parliament this year. 
Problems uncovered during an audit of the RCMP’s exempt data banks raised such 
significant concerns that the Commissioner decided to present the findings in a special 


report tabled in February 2008. 
We also completed a comprehensive examination of passport operations. (See page 15.) 


Other issues our Audit and Review branch worked on over 2007-2008 included the 
government’s purchase of personal information from data brokers and the widespread 
use of Social Insurance Numbers. 


We also conducted reviews of Privacy Impact Assessments for new federal initiatives, 
offering hundreds of recommendations to help protect Canadians’ privacy. 


RCMP Exempt Databanks — A Special Report to Parliament 


An OPC audit found the RCMP’s exempt data banks, which shelter national security 
and criminal intelligence files from public access, have been crowded with tens of 
thousands of records that should not have been there. This conclusion is particularly 
disturbing given that the RCMP was advised of compliance problems 20 years ago and 
made a commitment to properly manage such banks. 


Exempt data banks serve to withhold the most sensitive national security and criminal 
intelligence information. Departments and agencies controlling such records will refuse 
to confirm or deny the existence of information in response to requests for access. 


People whose names appear in the RCMP’s exempt data banks could be at risk of 


harmful impacts. For example, they could have trouble obtaining an employment 
security clearance or crossing the border. 
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More than half of the files examined as part of our audit did not belong in the exempt 
banks. To illustrate, one seven-year-old file in the national security exempt bank detailed 
a resident’s tip that a man had gone into a rooming house and drugs might be involved. 
Police investigated, but found the man had simply dropped his daughter off at a nearby 


school and stepped out of his car to smoke. 


The Privacy Commissioner was satisfied the RCMP was taking her recommendations 
seriously and would take action to ensure its exempt banks comply with the Privacy Act 


and RCMP policy. Our Office will conduct a post-audit. 
The complete audit report is available on the OPC website. 


Project Shock 


The RCMP’s National Security Investigations Records exempt bank includes records 
related to “Project Shock” — the effort to coordinate tips related to the 9-11 terrorist 
attacks. 


We examined a sample of records in 2002 and found tips generally related to suspected 
terrorist affiliations, suspicious persons or suspicious activity. However, some tips seemed 
to amount to little more than public hysteria during a time of crisis. 


While these files were not part of our exempt bank audit, we asked questions in order to 
verify that each tip file had undergone an assessment to determine whether it warranted 
continued exempt bank status. 


As we reported in our special report, a subsequent RCMP review of the Project Shock 
file, which contained records that touch on thousands of Canadians, found the records 
did not meet the criteria for continued inclusion in the national security exempt bank 

and were removed. 


Data Mining and the Public Sector 


Concerns about how data brokers collect, use and disclose personal information have 
been on our radar screen for a number of years. As well, privacy concerns have been 
highlighted in a number of studies and high-profile incidents involving data brokers. 


In late 2006, the Ottawa Citizen published an article describing how the RCMP had 
been buying and storing personal information from commercial data brokers for a 
number of years. This revelation raised questions not only about how the RCMP was 
using the information, but also about whether other government departments were 
purchasing data broker information. 
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Data brokers collect and analyze personal information — for example, financial, credit or 
health information — for the purpose of developing and selling data products, often to 
marketers. From a privacy perspective, we have concerns about the accuracy of this kind 
of data as well as the possibility that incorrect assumptions about individuals may be 
drawn. 


The RCMP advised our Office that it has contractual agreements with a number of data 
brokers which provide commercial reports for public and private companies, and contact 
information (address and telephone numbers) for consumers and businesses. 


The extent of data broker use within the RCMP varies depending on the mandate of the 
operational unit. For example, RCMP Commercial Crime Units may prepare economic 
profiles on individuals and companies in the course of bankruptcy investigations. 


The RCMP told us that information from data brokers complements the force’s 
intelligence and investigative work, and is only considered as a secondary source of 
information of unknown relevance, accuracy and reliability. We understand no action is 
undertaken solely on the basis of such information. 


Our Office also conducted a limited survey to assess the use of data brokers by other 
federal government departments. We concluded the use of data brokers does not appear 
to be widespread. 


Treasury Board Secretariat has told us that it will consider the data broker issue as it 
reviews the Treasury Board Privacy Impact Assessment Policy, which is scheduled to be 
completed by April 2009. 


Use of Social Insurance Numbers 


A senior citizen wrote to the Privacy Commissioner in June 2007 to express concern about 
the inclusion of Social Insurance Numbers on Old Age Security identification cards. 

‘The citizen pointed out that this was forcing older Canadians to reveal sensitive personal 
information each time they used the card to obtain privileges such as seniors’ discounts. 


The letter prompted our Office to contact Human Resources and Social Development 
Canada to raise the concerns. A few months later, the department informed us that 
Social Insurance Numbers would no longer be printed on the cards. 


This Social Insurance Number was created in 1964 to serve as a client account number 
for the Canada Pension Plan and various employment insurance programs. In 1967, 
what is now Canada Revenue Agency (CRA) started using Social Insurance Numbers 
for tax reporting purposes. 
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A recent OPC study found that over 70 federal departments and agencies use Social 
Insurance Numbers in one way or another. Meanwhile, approximately 170 pieces of 
provincial legislation deal with uses of Social Insurance Numbers. 


Despite the efforts of governments, our Office, other privacy commissioners, privacy 
advocates and citizens to limit the use of Social Insurance Numbers, over many years, 
the use of this number has snowballed to the point where many see it as a de facto 
common client identifier, if not a national identifier. 


At the same time, there is no legislated privacy protection related to the use of Social 
Insurance Numbers. This is a significant concern given that a Social Insurance Number 
is a key piece of information to unlock the door to an individual’s personal information. 
For example, identity thieves use it to apply for credit cards and open bank accounts. 


Treasury Board Secretariat recently issued a new policy governing the use of Social 
Insurance Numbers and whether this helps curtail the use of this number remains to be 
seen. 


Privacy Impact Assessment Reviews 


Privacy Impact Assessments (PIAs) are an important privacy management tool to help 
federal government institutions identify and mitigate privacy risks before implementing 


PIAs by the Numbers 
PIAs — which are mandated by Treasury Naw PIAs cent to ine OPC ar 60 


Board Secretariat policy — are meant to 
help departments focus on privacy as a 


programs. 


review 


PIAs reviewed and letters 78 


core consideration when implementing : 
of recommendation sent to 


new programs and initiatives. Our 


Office believes PIAs should be departments (includes “es 

mandated under the Privacy Act. (See received in prior years) 

page 44 for more detailed information.) Recommendations made by 434 
OPC to departments 

The OPC’s Audit and Review Branch Requests made to 239 

reviews submitted PIAs to evaluate the | departments for information 

privacy risks of government programs missing from PIAs 


and services, and offers advice where 
appropriate. In this way, the OPC can 


ensure that privacy safeguards are built in to programs and systems. 
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Our Office was pleased to note that, increasingly, departments are inviting OPC officials 
to early consultation meetings during — or even before — the PIA development stage. 
This allows the OPC to provide ideas on best practices and offer early alerts about the 
privacy risks related to new programs and initiatives. 


A key branch priority in 2007-2008 was to reduce a PIA review backlog. Over the year, 
the backlog of files waiting for review was significantly reduced from 50 files to 18. 


We reviewed 78 PIAs for a wide range of government programs and initiatives. Some 
of these were for controversial and high-profile projects, such as Transport Canada’s no- 
fly list and Canada Border Service Agency’s Enhanced Driver’s Licence initiative. Our 
Office also reviewed the privacy risks of lesser-known initiatives: a new benefits program 
for veterans; the recording of phone calls at Canada’s ports; and the process for handling 
passport applications at Service Canada locations. 


In most cases, we uncover privacy risks and make recommendations. Our advice is 
usually taken seriously. 
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Examples of Privacy Impact Assessment Reviews 


Transport Canada — Passenger Protect Program (No-fly List) 


While our Office continues to have significant concerns about the inherent privacy risks 
stemming from the no-fly list, our review of Transport Canada’s PIA of the program did result in 
some improvements. 


For example, in response to the OPC’s recommendations, Transport Canada put in place our 
suggestions for passenger recourse; an audit of the program's effectiveness; confidentiality 
provisions in memoranda of understanding; and standard operating procedures for RCMP and 
CSIS to guide their actions when someone is denied boarding. 


However, a recommendation that the personal information of individuals who are denied 
boarding not be shared with local police forces was not fully implemented. 


Similarly, our proposal that the Passenger Protect Program, as well as other watch lists, be 
referred to a Parliamentary committee for review in an open and transparent forum was rejected. 


Statistics Canada - Canada Health Measures Survey 


Our review of the Canada Health Measures Survey - a national survey that will collect information 
from Canadians about their general health and lifestyles — initially recommended against the 
planned storage of survey participants’ samples of blood, urine and DNA for unlimited lengths of 
time, to be used for unspecified future research. 


Our Office felt this practice would render participants’ consent to the collection of their samples 
somewhat meaningless. 


The OPC recommended Statistics Canada store the biological samples, identified only by 
anonymous code, for a specific period of time, not exceeding 20 years. We also recommended the 
survey should not include the option of long-term storage for biological specimens from young 
respondents (aged 6 to 13 years) where consent was to be provided by a parent or guardian. 


Statistics Canada decided to go ahead with the indefinite storage plan. It proposed that an 
oversight committee of interested parties such as the OPC could review the ways in which stored 
specimens may be used in the future. The plan to store children’s biological samples will also 
proceed; however, those individuals will be contacted after their 14" birthdays to obtain explicit 
consent. 
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RCMP / Public Safety Canada - National Integrated Information Initiative 


The National Integrated Information Initiative (N-III) is an electronic records-sharing program 
linking national, provincial and municipal police forces, with the capacity to expand access and 
sharing capabilities to federal government departments. 


The initiative is a partnership involving the RCMP, Public Safety Canada and a number of 
departments and agencies such as the Canada Border Services Agency, Citizenship and 
Immigration Canada, the Canadian Firearms Centre, Correctional Service of Canada and the 
National Parole Board. 


Given the significant number of institutions involved, the OPC asked Public Safety Canada to 
develop an over-arching PIA which would include a privacy management framework with 
measurable standards and limitations for all government agencies accessing and sharing 
information through systems, such as the Police Information Portal. 


We had hoped such a PIA would: outline the overall business case defining and justifying the 
need for the proposed increased information sharing; articulate a Public Safety commitment 

to protect personal information; set measurable standards against which audits for compliance 
within each portfolio department could be accomplished; and include a communications 
strategy for informing Canadians about how the program may lead to their personal information 
being shared with a number of government institutions. 


A year after the request was made, we have yet to receive an over-arching PIA, although our 
Office was informed in the spring of 2008 that work on a broad assessment had begun. 


Canada Border Services Agency - Enhanced Drivers’ Licences 


Our Office has been working with the British Columbia Information and Privacy Commissioner 
during our review of the Enhanced Drivers’ License (EDL) pilot project between British Columbia 
and Washington State. Canada Border Services Agency is encouraging and helping to coordinate 
the B.C. pilot as well as EDL projects in other provinces. 


EDLs are being proposed as an alternative to a Canadian passport for travellers entering the 
United States at land borders. They are a response to new U.S. government rules requiring 
documentation of identity and citizenship. 


Under the B.C. pilot, Canada Border Services Agency collects applicants’ personal information 
from the province and transfers it to U.S. Customs and Border Protection. 


Concerns raised during our PIA review include the duplication of personal information and data 
verification processes which already exist at Passport Canada. Other concerns include: unclear 
legislative authority for citizenship verification; meaningful consent; potential uses of personal 
information by the U.S. government; the use of EDLs for other purposes; and privacy risks related 
to the use of radio frequency identification (RFID) chips. 


The OPC has pressed Canada Border Services Agency for assurances that subsequent EDL 
projects will not proceed on a permanent basis unless drivers’ personal information remains in 
Canada, and that EDL information will only be used for crossing the border. While the way in 
which personal information will be disclosed to U.S. authorities was still under discussion as we 
prepared this report, Canada Border Services Agency has said the database itself will remain in 
Canada. 
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INTHE COURTS (ii. mieanD Ae eS 


As in previous years, there were only a few court applications proceeding under the 


Privacy Act in 2007-2008. 


Under section 41 of the Privacy Act, the Under section 41 of the 
Federal Court may only review a government Privacy Act, the Federal 
institution’s refusal to grant access to personal ; 
information requested under the Ac¢. Court may only review a 
government institution's 
A section 41 application may not be made refusal to grant access 
for wrongful collection, use or disclosure of ; ‘ 
ier aoe Bie to personal information 

an individual's personal information by a 

government institution. requested under the Act. 


Our Office has called on the federal government to broaden the grounds for which an 
application for court review under section 41 may be made to include the full array of 
privacy rights and protections under the Privacy Act. We also recommended giving the 
Federal Court the power to award damages against offending institutions. 


Until the Acz is amended, there will continue to be only a small number of court 
applications proceeding under the legislation. 


The following cases of interest were before the Federal Court during 2007-2008. 


In keeping with the spirit of our mandate, we do not publish the plaintiff’s name in 
order to protect the privacy of the complainants. The court docket number and the name 
of the respondent institutions are listed. 


X. v. Office of the Privacy Commissioner of Canada 
Federal Court File T-1903-07 


The Applicant filed a complaint against the Canadian Security Intelligence Service 
(CSIS) for failing to provide requested personal information. The Privacy Commissioner 
found the complaint was not well-founded. 


The Applicant sought judicial review of the Privacy Commissioner’s findings pursuant 
to section 41 of the Act. However, the purpose of a section 41 application is to ask the 
Court to determine whether the government institution against whom a complaint 
was filed respected the applicable provisions of the Act in refusing to provide access 

to personal information sought by the complainant. Section 41 does not provide for 
recourse against the Privacy Commissioner. 
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Mr. Justice Blanchard ruled that it is well established that the Privacy Commissioner 
has no decision-making authority and her findings and recommendations following an 
investigation under the Act are not binding on the government institution. 


He also noted it is clear under the Ac¢ that it is not the Privacy Commissioner who is 
called upon to justify a refusal. That responsibility rests with the government institution 
refusing to grant access to requested personal information. 


The Court therefore allowed the Privacy Commissioner’s motion, ordering that the 
application proceed only on condition that the Applicant file an amended application 
directed at CSIS. The Applicant filed an amended application in March 2008. 


Intervention in a Matter Involving the Access to Information Act 


X. v. The Minister of Health Canada 
Federal Court File No.: T-347-06 


As reported in the 2006-2007 annual report, the Privacy Commissioner was granted 
intervener status in a case filed under the Access to Information Act which raises important 
privacy issues. Our Office was concerned about the possible re-identification of individuals 
when government information is combined with publicly available information. 


The Applicant, a CBC producer, had sought access to Health Canada’s Canadian 
Adverse Drug Reaction Information System — a database containing information 
relating to suspected adverse reactions to health products marketed in Canada. 


In response to his request, Health Canada released some information, but refused to 
reveal the provinces in which data about adverse drug reactions had been collected on 
the grounds that it constituted personal information under the Privacy Act. 


In a February 2008 decision, Mr. Justice Gibson accepted a fundamental premise set out 
by the Supreme Court of Canada: In a situation involving personal information about 
an individual, the right to privacy is paramount over the right of access to information. 


He also adopted the legal test proposed by our Office: “Information will be about an 
identifiable individual where there is a serious possibility that an individual could be 
identified through the use of that information, alone or in combination with other 
available information.” 


Based on the evidence before him, Justice Gibson concluded that disclosure of the 


province would substantially increase the possibility that an individual could be 
identified based on the totality of data-fields already disclosed from the drug reaction 
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database, combined with other publicly available information, such as obituary notices. 
This is particularly the case for unique or quasi-unique individual reports, in smaller 
provinces or territories. 


Therefore, in the circumstances, the province field does constitute personal information 
and was properly exempt from access. 


Also of note, the judge emphasized the importance of ministerial discretion in deciding 
whether or not to exceptionally release this personal information in the public interest. 
In this case, the Minister had properly considered the facts before him and decided that, 
here, the public interest in disclosure did not clearly outweigh the violation of privacy 
that could result from the disclosure. 


ACCESS TO INFORMATION AND PRIVACY UNIT 


Our Office has now completed one full fiscal year subject to both the Access to 
Information Act and the Privacy Act. (The Federal Accountability Act extended both of 
these pieces of legislation so that they would cover our Office.) 


We received 44 formal requests under the Access to Information Act. Fourteen of those 
requests were transferred to government institutions which had control of the records 
being sought, and we responded to 29 requests for access to information in our Office. 
One other request was carried over. All Access to Information Act requests were responded 
to within the statutory time frames. 


Our Office received five complaints from two people under the Access to Information 
Act — three alleged denial of access and two concerned response time. The Information 
Commissioner concluded two access complaints were “not substantiated” and the 
third was “resolved.” The Information Commissioner further concluded that one time 
complaint was “not substantiated” and the other was “resolved.” 


Our Office received 45 requests for personal information under the Privacy Act. We 
redirected 23 requests to government institutions which had the information being 
sought, and we responded to 22 requests for access to OPC information. All Privacy Act 
requests were responded to within the statutory time frames set out in the Act. 


The OPC received two complaints under the Privacy Act from one individual alleging 
denial of access. The complaints were addressed under an arms-length process and were 


determined to be “not well-founded” in April 2008. 


‘The Federal Accountability Act does not include a mechanism under which Privacy 
Act complaints against our Office would be investigated. Given the fact it would 
be entirely inappropriate for our Office to investigate its own actions with respect 


86 


Otuer OPC Activities 


to its administration of the Privacy Act, we have created the position of “Privacy 
Commissioner ad hoc” to conduct such investigations. 


In September 2007, the Honourable Mr. Justice Peter Cory was engaged as Privacy 
Commissioner ad hoc. The Privacy Commissioner delegated to him the majority of her 
powers, duties and functions as set out in sections 29 through 35 and section 42 of the 
Act. Justice Cory completed his contract in March 2008. A new Privacy Commissioner 
ad hoc, Justice Andrew Mackay, has since assumed these duties. 


A substantial number of the requests we have received under both the Access to 
Information Act and the Privacy Act were for the contents of our investigation files. In a 
few cases, all file information was withheld as required by the Access to Information Act 
and the Privacy Act because the investigation or court proceedings were ongoing. Where 
an investigation was fully concluded, the file information was processed and access was 
granted subject to relevant exemptions. 


| INTERNATIONAL CONFERENCE CONFERENCE 


As reported in our 2007 PIPEDA Annual Report, the success of the 29th International 
Conference of Data Protection and Privacy Commissioners — held in Montreal in 
September and following through on our initial 2002 engagement — was beyond our 
highest expectations. 


We welcomed more than 600 commissioners, academics, privacy professionals, 
advocates, government officials, IT specialists and others from around the globe — 
making it the largest-ever conference of its kind. Most importantly, the positive reviews 
and kudos from participants justified the time and resources invested in this event. 


The conference theme was Privacy Horizons: Terra Incognita. Early cartographers 
marked unknown lands that had yet to be mapped with this Latin term. One of the 
earliest known terrestrial globes from Europe labels an uncharted edge of the ocean “hic 
sunt dracones” — or “here be dragons.” 


This notion of an unknown landscape with lurking dragons seemed the perfect 
metaphor for the future of privacy. Privacy issues are changing rapidly, with powerful 
new technologies and the international war on terror acting as potent forces which 
threaten the privacy of people around the world. 


The goal of our conference was to begin to chart what the privacy world of the future 
might look like and also to equip privacy advocates with some strong dragon-slaying 
tools. During a series of plenaries, workshops and information sessions, we considered 
the best strategies for defending privacy rights in the face of constant change. 


87 


Annuat Report To ParLiAMENT 2007-2008 — Report on THE Privacy Act 


Participants heard from the who's who of the privacy world, including security 
technology guru and author Bruce Schneier; Simon Davies, a pioneer of the 
international privacy arena and founder of Privacy International; consumer privacy 
advocate Katherine Albrecht; Marc Rotenberg, executive director of the Electronic 
Privacy Information Center; Peter Fleischer, Google’s global privacy counsel; Peter 
Hustinx, the European Data Protection Supervisor; as well as Peter Schaar, now past- 
chair of the EU Article 29 Data Protection Working Party and France’s Alex Ttirk, who 
is now chair of the working party. Our guest of honour, who opened the conference, was 


the Honourable Peter Milliken, Speaker of the House of Commons. 


The conference program underscored the wide range of issues which will have an impact 
on privacy in the coming years as well as the increasingly global nature of privacy issues. 


We prepared 14 workbooks before the conference. Most included a commissioned 
paper by a subject-matter expert and a variety of other resources, such as research and 
bibliographical materials, to satisfy the curiosity of participants who might be new 

to a particular subject, as well as the more rigorous requirements of key policy and 
decision-makers to locate trustworthy information about the privacy implications 

of our conference topics. These are available on our conference website at www. 
privacyconference2007.gc.ca and are an important legacy of the conference. 


We have posted details about the cost of the conference on our website. We stayed well 
within our overall financial targets. 
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‘The list of issues our Office deals with on a daily basis will always be a lengthy one. In 
an effort to focus our efforts on the most significant threats to the privacy of Canadians, 
we have identified four top strategic priorities: information technology, national security, 
identity integrity and protection, and genetic information. 


A key objective for our Office over 2008-2009 will be to provide leadership on our 
priority issues. Our plans to address these privacy threats include the following steps: 
e Information Technology 


o Build sufficient capacity to assess the privacy impact of new information 
technologies. 


o Increase public awareness of technologies with potential privacy impacts. 
o Provide practical guidance to organizations on the implementation of 
specific technologies. 
e National Security 
o Ensure national security initiatives adequately protect privacy. 


o Ensure proper oversight and accountability of national security agencies’ 
personal information management practices. 


o Raise public awareness of the privacy impacts of national security 
initiatives. 
e Identity Integrity and Protection / Identity Theft 
o Improve organizations’ personal information management practices. 
o Raise public awareness of identity protection. 


o Advocate for a coordinated federal government approach to identity 
protection. 
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e Genetic Information 


o Advance research and knowledge to address new challenges posed by 
genetics in the context of traditional data protection regimes. 


o Raise public awareness about the potential uses of genetic information. 
Our Office has identified four other major corporate priorities. They are: 


e Continue to improve service delivery through focus and innovation, including 
new investigative strategies to make our complaints resolution process more 
efficient; 


e Build a sustainable organizational capacity by growing our Office and 
continuing an information management renewal project; 


e Support Canadians to make informed privacy decisions with expanded public 
education initiatives such as a social marketing campaign on children’s online 
privacy and outreach programs in partnership with provincial and territorial 
privacy commissioners; and 


e Strategically advance global privacy protection for Canadians through work 
with organizations such as the OECD and APEC. 
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| DEFINITIONS OF COMPLAINT TYPES | OF COMPLAINT TYPES | 


Complaints received in the OPC are categorized into three main groups: 


Access: 


e Access — All personal information has not been received, either because some 
documents or information are missing or the institution has applied exemptions 
to withhold information. 


e Correction/Notation — The institution has failed to correct personal 
information or has not placed a notation on the file in the instances where it 
disagrees with the requested correction. 


e Language — Personal information was not provided in the official language of 
choice. 


e Fee-Fees have been assessed to respond to a Privacy Act request; there are 
presently no fees prescribed for obtaining personal information. 


e Index —Infosource (a federal government directory that describes each 
institution and the banks of information — groups of files on the same subject 
— held by that particular institution) does not adequately describe the personal 
information holdings of an institution. 


Privacy: 

e Collection — Personal information collected is not required for an operating 
program or activity of the institution; personal information is not collected 
directly from the individual concerned; or the individual is not advised of the 
purpose of the collection of personal information. 


e Retention and Disposal — Personal information is not kept in accordance 
with retention and disposal schedules (approved by the National Archives and 
published in Infosource): either destroyed too soon or kept too long. 


In addition, personal information used for an administrative purpose must 
be kept for at least two years after the last administrative action unless the 
individual consents to its disposal. 


91 


ANNUAL Report To ParLiaMeNtT 2007-2008 — Report on THE Privacy Act 


e Use and Disclosure — Personal information is used or disclosed without the 
consent of the individual and does not meet one of the permissible uses or 
disclosures without consent set out in sections 7 and 8 of the Act. 


Time Limits: 
e Time Limits — The institution did not respond within the statutory limits. 


e Extension Notice — The institution did not provide an appropriate rationale 
for an extension of the time limit, applied for the extension after the initial 30 
days had been exceeded, or applied a due date more than 60 days from date of 


receipt. 


e Correction/Notation - Time Limits — ‘The institution has failed to correct 
personal information or has not placed a notation on the file within 30 days of 
receipt of a request for correction. 


DEFINITIONS OF FINDINGS AND OTHER DISPOSITIONS UNDER THE PRIVACY ACT 


The OPC has developed a series of definitions of findings to explain the outcome of its 
investigations under the Privacy Act. 


Early resolution: Applied to situations in which the issue is dealt with before a formal 
investigation is undertaken. For example, if an individual complains about an issue 

the OPC has already investigated and found to be compliant with the Privacy Act, we 
explain this to the individual. We also receive complaints in which a formal investigation 
could have adverse implications for the individual. We discuss the possible impact at 
length with the individual and should he or she choose not to proceed further, the file is 
closed as “early resolution”. 


Not Well-founded: The investigation uncovered no or insufficient evidence to conclude 
that the government institution violated the complainant’s rights under the Privacy Act. 


Well-founded: The government institution failed to respect the Privacy Act rights of an 
individual. 


Well-founded/Resolved: ‘The investigation substantiated the allegations and the 
government institution has agreed to take corrective measures to rectify the problem. 


Resolved: After a thorough investigation, the OPC helped negotiate a solution that 


satisfied all parties. The finding is used for those complaints in which well-founded 
would be too harsh to fit what essentially is a miscommunication or misunderstanding. 
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Settled during the course of the investigation: The OPC helped negotiate a solution 
that satisfied all parties during the investigation, but did not issue a finding. 


Discontinued: The investigation was terminated before all the allegations were fully 
investigated. A case may be discontinued for any number of reasons —the complainant 
may no longer be interested in pursuing the matter or cannot be located to provide 
additional information critical to reaching a conclusion. 
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APPENDIX 2 


INVESTIGATION PROCESS UNDER THE PRIVACY ACT 


Inquiry: 
Individual contacts OPC by letter, by telephone, or in person to complain of violation of the Act. Individuals who make contact in 
person or by telephone must subsequently submit their allegations in writing. 


4 


Initial analysis: 
Inquiries staff review the matter to determine whether it constitutes a complaint, i.e., whether the allegations could constitute a 
contravention of the Act. 


An individual may complain about any matter specified in section 29 of the Privacy Act — for example, denial of access, or 
unacceptable delay in providing access to his or her personal information held by an institution; improper collection, use or 
disclosure of personal information; or inaccuracies in personal information used or disclosed by an institution. 


¥v 
1 ree Complaint? eee | 
No: Yes: 
The individual is advised, for example, that the matter is An investigator is assigned to the case. 


not in our jurisdiction. 


Investigation: 
The investigation provides the factual basis for the Commissioner to determine whether 
the individual's rights under the Privacy Act have been contravened. 


Early resolution? 
A complaint may be resolved 
before an investigation is 
undertaken if, for example, the 
issue has already been fully 
dealt with in another complaint 
and the institution has ceased 


investigator gathers the facts related to the complaint through representations from 
both parties and through independent inquiry, interviews of witnesses, and review of 
documentation. Through the Privacy Commissioner or her delegate, the investigator has 
the practice or the practice does 4 Re : ‘ ; 
the authority to receive evidence, enter premises where appropriate, and examine or 
not contravene the Act. 


1 
1 
1 
i] 
1 
1 
i] 
1 
i] 
1 
1 
i] 
1 
1 
i] 
pe ceahhe ame Sisee Re oa 3 obtain copies of records found on any premises. 


! 
1 
1 
1 
1 
1 
: The investigator writes to the institution, outlining the substance of the complaint. The 
1 
1 
i] 
i] 
1 
‘ 
i 
1 


Discontinued? Analysis (on next page) 
A complaint may be 
discontinued if, for 


1 
1 
i] 
i] 
1 
1 
example, acomplainant 1 
i] 
1 
i 
i] 
1 
1 


q¢-------------- 


decides not to pursue it, 
ora complainant cannot 
be located. 


Note: a broken line (- - - - ) indicates a possible outcome. 
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$$ 


Analysis: 
The investigator analyzes the facts and prepares recommendations to the Privacy Commissioner or her 
delegate. The investigator will contact the parties and review the facts gathered during the course of the 
investigation. The investigator will also tell the parties what he or she will be recommending, based on the 
facts, to the Privacy Commissioner or her delegate. At this point, the parties may make further representations. 


Analysis will include internal consultations with, for example, Legal Services or Research and Policy Branches, 


as appropriate. 
Mars 
pw wr em eM Mee ee ee ee ee ee ee eee ee ee 4 ' 
6 RE 6 7 1 ' 
! : v 
a Findings: 
: : The Privacy commissioner or her delegate reviews the file and assesses the report. The Privacy 
_---%_.%__, (ommissioner or her delegate, not the investigator, decides what the appropriate outcome should be and 
whether recommendations to the institution are warranted. 
; Settled? | 
| The OPCseeksto ' The Privacy Commissioner or her delegate sends letters of findings to the parties. The letters outline 
resolve complaints the basis of the complaint, the relevant findings of fact, the analysis, and any recommendations to the 
1 and to prevent 1 __ institution. The Privacy Commissioner or her delegate may ask the institution to respond in writing, within a 
; contraventions | _ particular timeframe, outlining its plans for implementing any recommendations. 
‘ fromrecurring. | ‘ ; 
! ' The possible findings are: 
The Commissioner . : 
1 encourages 1 Not Well-Founded: The evidence, on balance, does not lead the Privacy Commissioner or her delegate to 
resolution through ; conclude that the complainant's rights under the Act have been contravened. 
1 ee 1 
1 Negotiation and =; Well-Founded: The institution failed to respect a provision of the Act. 
| persuasion. The =} 
t investigator assists 1 Well-Founded, Resolved: The investigation substantiated the allegations and the institution has agreed 
t inthis process. | _ to take corrective measures to rectify the problem. 
1 1 
ee + Resolved: The evidence gathered in the investigation supports the allegations raised in the complaint, but 


the institution agreed to take corrective measures to rectify the problem, to the satisfaction of this Office. 
The finding is used for those complaints in which Well-Founded would be too harsh to fit what essentially is 
a miscommunication or misunderstanding. 


In the letter of findings, the Privacy Commissioner or her delegate informs the complainant of his or her 
rights of recourse to the Federal Court on matters of denial of access to personal information. 


' been made to an institution, OPC 
I A 

1 Staff will follow up to verify that 
| they have been implemented. 


| The complainant or the Privacy Commissioner may choose to apply to the 
; ' Federal Court for a hearing of the denial of access. The Federal Court has the 
power to review the matter and determine whether the institution must 
provide the information to the requester. 


Note: a broken line (- - - - ) indicates a possible outcome. 
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PRIVAC YACT INQUIRY, COMPLAINT AND INVESTIGATION STATISTICS FOR 2007-2008 
Inquiries 


Our Inquiries Unit received well over 4,000 Privacy Act-related inquiries between April 
1, 2007 and March 31, 2008. 


Some of the most frequently raised issues included ways in which to make formal 


requests for access to personal information; how to file complaints against government 
institutions that, for example, exceed statutory time limits and fail to comply with the 
Privacy Act. We also received inquiries from individuals seeking advice from our Office 
as a result of being affected by various privacy breaches. 


Privacy Act inquiries received by the Inquiries Unit 


Telephone inquiries BAe, 


Written inquiries (letter, e-mail, fax) 2,059 
Total number of inquiries received 4,258 
Telephone inquiries 2,221 
Written inquiries (letter, e-mail, fax) 1,901 
Total number of inquiries closed 4,122 
Telephone inquiries D234 
Written inquiries (letter, e-mail, fax) : 136 
Total number of inquiries received 2,367 
Telephone inquiries 2,229 
Written inquiries (letter, e-mail, fax) 140 
Total number of inquiries closed 2,369 


“These are inquiries related to privacy issues, but cannot be linked to either Act. 
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Complaints Received by Type 
| Complaint Type! i Count | Percentage | 


Access © 292 38 
Time Limits 259 34 
Use and Disclosure 124 16 
Collection 33 4 
Correction-Time Limits 26 3 
Extension Notice 10 1 
Retention and Disposal 9 1 
Correction-Notation 5 1 
Language 1 <1 
Total 759 


As in previous years, the most common complaints to our Office related to both access 
to personal information as well as the length of time government departments and 
agencies take to respond to access requests. 


See Appendix 1 for definitions of complaint types. 


Top Ten Institutions by Complaints Received 


Access to Personal 
Total 
stoner 


Correctional Service Canada 151 

Royal Canadian Mounted Police _ 3 14 a 
Canada Border Services Agency 54 18 Bil 5 
Service Canada 52 13 14 25 
National Defence 48 17 19 12 
Canadian Security Intelligence Service 45 44 0 1 
Canada Revenue Agency 38 18 9 11 
Canada Post Corporation 28 16 8 4 
Foreign Affairs and International Trade 27 6 vi 14 
Justice Canada 18 4 13 1 
Others Wily 49 29 39 
Total 759 292 295 172 


Some institutions — because of their mandate — hold a substantial amount of personal 
information and are more likely to receive numerous requests for access to that 
information and subsequent complaints. 


See Appendix 1 for definitions of complaint types. 
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Complaints Received by Institution 


Correctional Service Canada 248 
Royal Canadian Mounted Police 84 
Canada Border Services Agency 54 
Service Canada 52 
National Defence 48 
Canadian Security Intelligence Service 45 
Canada Revenue Agency 38 
Canada Post Corporation 28 
Foreign Affairs and International Trade Canada 27 
Justice Canada 18 
Human Resources and Social Development Canada 14 
Citizenship and Immigration Canada 14 


Health Canada 

Transport Canada 

Public Works and Government Services Canada 
Fisheries and Oceans 

Library and Archives Canada 

Privy Council Office 

Agriculture and Agri-Food Canada 

Canadian Food Inspection Agency 

Indian and Northern Affairs Canada 

Treasury Board of Canada Secretariat 

Commission fer Public Complaints Against the RCMP 
Environment Canada 

Public Service Commission Canada 

Canada Firearms Centre 

Canada Mortgage and Housing Corporation 

Canada Public Service Agency 

Ombudsman National Defence and Canadian Forces 
Canadian Broadcasting Corporation 

Canadian Forces Grievance Board 

Canadian Human Rights Agency 

Canadian Transportation Agency 

Correctional Investigator Canada 

Export Development Corporation 

Financial Transactions and Reports Analysis Centre of Canada 
Immigration and Refugee Board 

Industry Canada 

Inspector General of the Canadian Security Intelligence Service, Office of the 
National Museum of Science and Technology 
National Parole Board 

Natural Resources Canada 

Pension Appeals Board Canada 

Public Safety Canada 

Public Service Labour Relations Board 

Public Service Staffing Tribunal 

Royal Canadian Mint 

Statistics Canada 

Veteran Affairs Canada 

Total 
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Complaints Received by Province/Territory 


ae ee ee ee 


Ontario 195 26 
British Columbia 179 28 
NCR 112 15 
Quebec 65 8 
Alberta 60 8 
Saskatchewan 44 6 
Nova Scotia 28 4 
Manitoba 26 3 
International * 22 3 
New Brunswick 15 2 
Newfoundland 5 1 
Prince Edward Island 4 1 
Nunavut 3} <1 
Yukon Territory 1 <1 
Total 759 


* Canadians living abroad have the same access and privacy protection rights under the 
Privacy Act as those living in Canada, including the right to complain to this Office. 
Some of these Canadians living abroad have chosen to exercise those rights. (Note: the 
privacy protection rights, but not access rights, are also available to all individuals of any 
citizenship or country of residence. 


We have seen one significant change in the geographical distribution of complaints over 
the last few years: There has been a sharp drop in the number of Quebec complaints, 
which accounted for 24 per cent of total complaints in 2005-2006; 14 per cent in 
2006-2007; and just 8 per cent in 2007-2008. While we can't be certain about the 
precise reason for this decrease, we are aware that Quebec has its own stringent privacy 
legislation. Most of our complainants living in Quebec who use our services, are located 


in the National Capital Region. 
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Closed Complaints by Finding 


rit es) Count -| Percentage | 


Early Resolution 32 4 
Settled 114 13 
Well-founded Resolved 17 2 
Resolved 6 il 
Well-founded 319 36 
Not Well-founded 275 31 
Discontinued Py, 13 
Total 880 


Roughly one in five of our closed complaints resulted in solutions that satisfied 
complainants, respondents and our Office — with an Early Resolution, Settled, Well- 
founded Resolved or Resolved finding. A significant number of closed complaints 

— more than one third — were well founded, which suggests that there is room for 
improvement in privacy management practices. 


Findings by Complaint Type 


Complaints (All Types) Closed 


Settled in Well- 
: : } Early Not well- Well- 
Discontinued p Resolved | course of founded/ | Total 
|_| at oe en ect investigation | fOUN4°4 | Resolved ot 
56 4 5 59 2 12 


Access 180 318 
Time Limits 14 18 23 0 3 243 0 301 
ae 32 4 51 1 31 42 3 +164 
Disclosure 

Collection 6 5 11 0 11 0 0 33 
SET 3 1 0 0 5 22 0 31 
Limits 

Extension Notice 1 0 3 0 0 10 0 14 
Retention and 3 0 4 0 4 0 1 12 
Disposal 

Correction- 

Notation : ° , : | . i is 
Total 117 32 275 6 114 319 17 880 


This table shows varying characteristics by Complaint Type. For instance, by their very 
nature, most Time Limits are well-founded; most individuals do not complain to us 
until the statutory deadline has passed. Seventy-five per cent of Access cases are either 
not well-founded or settled, meaning that the exemptions were properly claimed and/ 
or individuals were satisfied with the explanation given of the reasons for exemptions or 
missing documentation. Interestingly, no Collection complaints were well-founded. This 
indicates several possible things: that the collection of personal information was indeed 
necessary and reasonable for the program or activity of the government institution, 
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that the individuals understood an explanation/rationale for the collection; or that 
discussions with the organizations were successful in reaching some compromise that 
was acceptable to both parties. 


Access and Privacy Complaints Closed 


Settled in Well- 
Early Notwell-|  Well- 
Discontinued course of founded- | Resolved | Total 
OE bo Jager investigation fender | nice — fa 


Access 59 180 318 
Use and 

Disclosure 32 4 31 51 42 3 1 164 
Collection 6 5 11 11 0 0 0 33 
Retention and 

Disposal 8 0 4 4 @) 1 0 12 
Correction- 

Notation 2 0 | 3 0 { 0 7 
Total 99 13 106 249 44 17 6 534 


As in previous years, not well-founded complaints outweigh those complaints that are 
well-founded. In addition, a number of complaints have been concluded using alternate 
resolution mechanisms, as is demonstrated by the number of settled complaints and 
early resolution findings. 


See Appendix 1 for definitions of findings and other dispositions under the Privacy Act. 


Time Limits Complaints Closed 


Settled in Well- 
Early Not well- Well- | wot 
Discontinued Resolved} course of founded/ Total 
Dba dieciebball ears se investigation | OUN4®*| Resolved 
243 301 


Time Limits 0 3 0 

Correction- Time 

Limits 3 1 0 0 5 22 ) 31 
Extension Notice 1 0) 3 0 0 10 0 14 
Total 18 19 26 0 8 275 0 346 


By their very nature, the majority of time limits complaints are well-founded. The 
requirements for federal departments and agencies are clear: They have 30 days to 
respond to requests for access to personal information. Some time limits complaints 
are not well-founded because the organization has appropriately applied an extension 
notice, which allows for an additional 30 days to respond. 
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Time Limits Complaints Closed by Institution and Finding 


As indicated in the following table, Correctional Services Canada has, by far, the highest 
number of Time Limits complaints. This is a reflection of the large volume of personal 
information it holds on inmates and the large number of requests it receives from 

that population. That institution recently received a significant increase in resources 

to address the volume. Likewise, National Defence, Canada Border Services Agency, 

the RCMP and the Canada Revenue Agency all have significant holdings of personal 
information and therefore face significant challenges in responding in a timely fashion 
to the high volume of requests they receive, with the resources they have available. 


Settled in 
Early Not well- Well- 
Discontinued course of Total 
i Peony ound investigation fomaied a 


Correctional Service Canada 146 174 
National Defence 26 28 
Canada Border Services Agency 

Royal Canadian Mounted Police 
Canada Revenue Agency 

Justice Canada 

Service Canada 

Canadian Security Intelligence Service 


Foreign Affairs and International Trade 
Canada 


Canada Post Corporation 
Citizenship and Immigration Canada 


Human Resources and Social Development 
Canada 


Canada Firearms Centre 
Privy Council Office 


Public Works and Government Services 
Canada 


Agriculture and Agri-Food Canada 

Health Canada 

Indian and Northern Affairs Canada 

Library and Archives Canada 

Correctional Investigator Canada, Office of the 
Environment Canada 

Export Development Corporation 

Fisheries and Oceans 


Inspector General of the Canadian Security 
Intelligence Service, Office of the 


Public Safety Canada 
Treasury Board of Canada Secretariat 
Total 


O00 CO OWOOsR HNUY 


Oo — 


Cia Oi © GO GO ci OO GO SS. Ot © © ta — cs © >) 
—-- - CONND WwW NOD YN UW CO OO 
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= 
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— 
-_ 
Wooo G2Ac Cc OF-—-f2D0OG Cc O02 CON CO BODO So 


OS © or © 2) © a — GO Oi © 


wet 
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8 275 346 
The increase in the number of well-founded time limit complaints can be directly 


attributed to the increase in requests institutions receive and the limited resources 
available to them. This trend affects the majority of government institutions. 
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APPENDIX 3 


Access and Privacy Complaints Closed by Institution and Finding 


Settled in 
Early | Not well- Well- 
Respondent Discontinued Resolution | founded Resolved} course of sounded alert Total 
investigation Resolved 


Correctional Service 


Canada 4 114 
Canada Revenue 

Agency 9 1 4 0 11 6 1 69 
Immigration and 

Refugee Board 5 0 58 0 0 0 0 58 
Royal Canadian 

Mounted Police 1 2 24 1 9 3 2 52 
Citizenship and 

Immigration Canada 1 16 0 1 0 0 35 
National Defence 10 1 9 0 3 2 1 26 
Canada Post Corporation 8 1 4 1 10 0 0 24 
Human Resources and 

Social Development 11 1 5 0 2 1 2 22 
Canada 

Service Canada 3 1 7 1 Hi 2 1 22 
Canada Border Services 

Agency 2 0 5 1 4 2 1 15 
Foreign Affairs and 

International Trade 1 1 6 0 2 4 0 14 
(Canada 

Justice Canada, 

Department of 0 a 0 2 l 1 10 
Fisheries and Oceans 0 0 0) 0 Z 0 0 L 
National Parole Board 1 0 1 0 2 ) 2 6 
Canadian Security 

Intelligence Service 0 0 2 0 0 0 0 5 
Health Canada 0 1 2 0 2 0 0 5 
Indian and Northern 

Affairs Canada 1 0 u 0 3 0 0 5 
Environment Canada 0 0 4 0 0 0 0 4 
Library and Archives 

ene 2: 0 0 0 2 0 0 4 
Statistics Canada 1 1 1 0 1 6) @) 4 
Transport Canada 2 0 0 0 0 0 4 
Canadian Human Rights 1 0 1 0 0 1 3 
Commission 

Freshwater Fish 

Marketing Corporation 0 : e 0 : 2 : 
Public Service 

Commission Canada 0 0 2 o : . 2 c 
Canada School for 

Public Service 0 Q ~ o 2 o : 

Privy Council Office 0 1 0 0 1 2 
Public Safety Canada 0 0 0 0 2 0 0 2 
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Access and Privacy Complaints Closed by Institution and Finding (cont.) 


Settled in 
Early | Not well- Well- 
Respondent Discontinued Resolved} course of ‘ieetedl Total 
etl a penne eae) i investigation |'4"4°4) Resolved ior 


Public Works and 


Government Services 1 0 

Canada 

Treasury Board of 

Canada Secretariat 2 0 2 0 0 0 0 2 
Agriculture and Agri- 

Food Canada o ° | 0 0 0 0 1 
Canadian Air Transport 

Security Authority c 0 1 0 0 0 0 1 
Canadian Food 

Inspection Agency L 0 0 1 
Canadian Space Agency 0 0 1 0 0 0 0 1 
Canadian Transportation 

Agency l 0 0 1 
Export Development 

Corporation 0 0 0 1 1 
Industry Canada 0 1 0 0 0 0 0 1 
Inspector General of 

the Canadian Security 

Intelligence Service, ° 0 l 0 0 0 0 1 
Office of the 

Office of the Chief 

Electoral Officer 0 L 0 0 0 1 
Veterans Affairs Canada 0 0 1 0 0 0 0 1 
Total 99 13 249 6 106 44 17 534 
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AppENDIX 3 


Complaint Investigations Treatment Times - Privacy Act 


Treatment times are the average number of months to complete a complaint 
investigation, from the date the complaint is received to when a finding is made. 


By Finding 

Early Resolution 6.25 

Well-founded 6.32 

Resolved 16.17 
Discontinued 16.57 
Settled in the Course of Investigation 17.87 
Not Well-founded 21.67 
Well-founded Resolved 27.24 
Overall Average 14.45 


The significant difference between treatment times for well-founded complaints and not 
well-founded complaints arises from Time Limits complaints. They represent 34 per 
cent of our caseload, the majority of which are well-founded, and the majority of which 
are closed relatively quickly compared to other types of complaints. 


By Complaint Type 

Time Limits 4.58 
Extension Notice 6.07 
Correction/Time Limit 7.10 
Correction/Notation 13.14 * 
Collection 16.09 
Use and Disclosure 18.68 
Access ; 22.14 
Overall Average 14.40 


*'The treatment time for this complaint type reflects seven cases. 
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